Corvusec exists to help organisations detect, respond to and withstand modern cyber threats through operationally proven security practices — not frameworks copied out of a compliance binder.
Our founder has spent over a decade inside the SOC — as an analyst, a threat hunter, and eventually as Head of SOC for a global life-sciences company overseeing 100k+ endpoints, leading the transformation of security operations from a shift-based model to a hybrid MSSP setup, and then to follow-the-sun coverage across IT, cloud and OT environments.
That experience includes supporting KRITIS and NIS2-driven audits directly, building and tuning detection use cases across SIEM, EDR and SOAR platforms, and coaching analysts through promotion from L2 to L3. Earlier in his career, he worked incident response and forensics for Masaryk University's CSIRT team.
Around him, Corvusec draws on a bench of eight other consultants — incident response, threat hunting, threat intelligence, offensive security, forensics and AI-augmented security specialists — all with hands-on experience in production security operations.
Every consultant at Corvusec has hands-on experience inside production security operations, so the advice reflects operational reality — not just what's written in the framework.
SOC transformation and NIS2/KRITIS readiness, drawn from running SOC operations for 100k+ endpoints.
Eight-plus years across national CSIRT, SOC leadership and enterprise threat research, now focused on LLM-assisted detection and hunting pipelines.
Leads a global 24/7 IR team and brings offensive testing experience to validate what defenders actually catch.
Runs offensive security and application security programmes, with a research background in malicious-behaviour detection.
Builds threat intelligence reporting for senior management and brings cloud security assessment experience to engagements.
Runs hypothesis-driven, MITRE-mapped threat hunts and detection engineering across SIEM and EDR.
Threat intelligence work paired with a background in law — a genuine asset when NIS2 findings need to hold up as governance documentation.
Tests web applications, networks and Active Directory, with prior research on SCADA/DNP3 protocol security.
Designs and runs the LLM and RAG pipelines behind our AI-augmented SOC work, alongside digital forensics and malware analysis.
Start with a short call. We'll tell you honestly whether a full maturity assessment is worth your time — before you spend a euro on it.
Or email us directly at hello@corvusec.eu