The people who do the work
Three named leaders. Credentials you can verify. Histories we keep short.
The three people accountable for every engagement are named below, with what each of them owns. Their qualifications can be independently checked with the bodies that issue them. What you will not find is a list of former employers, clients or engagement dates — and that is a deliberate decision rather than an omission.
Gareth Morgan
Gareth is an experienced cyber security leader with a background in security intelligence, risk and information assurance.
He leads Cyber-Safe’s focus on independent, pragmatic cyber security and data protection assurance, with a particular interest in emerging threats, AI governance and organisational resilience.
Outside work, his interests include Welsh history, military history, technology and the outdoors.
What Gareth is accountable for
Ingrid Lindberg
Ingrid is a cyber security leader with a career spanning the insurance and financial services sectors, as well as innovative AI start-up and research environments, with a background in cyber risk management, threat intelligence and security architecture.
She leads Cyber-Safe’s technical security assurance, emerging threats and digital resilience work, with a particular interest in cloud security, AI governance and security.
Originally from Sweden, her interests include Scandinavian design, emerging technology, travel and the outdoors.
What Ingrid is accountable for
Alistair Donnelly
Alistair is a privacy and information-governance leader with a background in data protection, regulatory compliance and organisational risk.
He leads Cyber-Safe’s UK GDPR compliance, privacy governance, DPIAs, breach preparedness and responsible AI work, drawing on experience across healthcare, financial services, technology, professional services, education and the public sector.
Outside work, his interests include Scottish history, hillwalking, photography and traditional music.
What Alistair is accountable forWhere the decisions stop
Who you would get, and for what. Three accountable people, and a bench of specialists engaged for the work each is genuinely best at.
What follows is not a list of job titles — it is a list of the decisions that stop somewhere, and the person each one stops with.
Chief Executive Officer
Gareth Morgan
Whether we take the work, and whether we can still say no once we have.
Scope, price and independence. The commercial terms of every engagement are set here, which is also where the refusals happen: work we are not competent to do, work where we would be assessing something we had sold, and work where the answer appears to have been decided before the assessment starts.
- Signs the engagement letter and owns the fixed price
- Holds the conflicts register and the vendor-independence position
- Named point of escalation if you disagree with a finding
Verify Companies House filings for Eurologix Security Holding Group Ltd, company number 11660724.
Chief Information Security Officer
Ingrid Lindberg
Every technical claim that reaches a board report is signed off here.
Testing, incident work, threat analysis, and the translation of a technical finding into a decision a board can actually take. If a report says a control is working, this is the role that has to be able to show why — and the role that has to defend it when your insurer, your auditor or your acquirer asks.
- Owns the control set and the evidence each control requires
- Reviews every assessment before it leaves the practice
- Leads incident work and the first-hour decisions
Verify Certifications are registered with ISACA and ISC2, both of which maintain public registers you can search yourself.
Chief Privacy Officer
Alistair Donnelly
Where the security answer and the legal answer differ, this is where that gets resolved.
UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025 in practice rather than in summary: what they require of you now, whether you can evidence it, and the point at which a security incident becomes a privacy obligation with a clock attached. Also cross-border transfers, and decisions made about people by automated means.
- Owns the breach-clock position and the Article 33 and 34 tests
- Transfer risk assessments, the IDTA and the UK Addendum
- Automated decision-making under Article 22 as amended by the DUAA
Verify IAPP verifies its credentials on request rather than through an open directory. Ask us and we will arrange it.
Beyond these three, the practice’s analysts and specialists are engaged by discipline — penetration testing, forensics, AI assurance, and the Crown Dependencies. You will be told who is working on your engagement before it starts, and what they are certified in.
Why these biographies are short
Detailed staff biographies are raw material for social engineering. Employment history, tenure dates, named clients and the shape of somebody’s career are precisely what an attacker assembles into a convincing pretext — a call from a former colleague, an email referencing a project, a request that arrives with just enough true detail attached.
We advise clients to think carefully about what their people publish. It would be difficult to give that advice and then ignore it ourselves.
So we publish who is accountable and what can be independently verified, and describe what each person actually does on an engagement. ISACA and ISC2 maintain public registers you can search yourself, and we would encourage you to. The IAPP verifies its credentials on request rather than through an open directory, so ask us and we will arrange it.
Where a client needs more, we provide detailed backgrounds under NDA as part of the engagement. Several of our clients require this, and it is a normal part of onboarding.
How we are set up
UK Cyber-Safe is built around three accountable leaders and a team of analysts and specialists, each engaged on the work they are genuinely best at. Nobody is assigned to an engagement to fill a diary. That is a deliberate choice: it keeps the practice independent of any vendor, and it means the person in the room is there because the engagement needs them.
Sister practice in North America. Organisations with Canadian operations, or a Canadian parent, should talk to Canada Cyber-Safe, our sister practice based in Toronto. It runs on the same principle, assess or remediate but never both, against PIPEDA and Quebec Law 25 rather than UK law, and it works with Canadian organisations only. Where an engagement spans both jurisdictions, the two practices coordinate and you are told which one is accountable for what.
You will be told who is working on your engagement before it starts, and what they are certified in. If you want more detail than this page carries, ask — we will provide it under NDA.
We are always interested in the right people
Joining the practice
The right person, not a vacancy
We do not recruit to a headcount and then look for work to fill it. We bring people in for the things they are genuinely best at, which means the practice grows one person at a time and only when there is something worth doing. If that is how you prefer to work — bounded engagements, in your specialism, with your name on the finding — we would like to know you exist before we need you.
We are most often looking for people in security assessment and incident work, UK data protection practice, cross-border data governance, and AI governance. If your specialism is not on that list and you think we are missing something, say so — that is a more interesting message than a covering letter.
What happens to your CV. It goes to one monitored address and is read by a named person. We keep it for twelve months and then delete it, unless you ask us to keep it for longer or to delete it sooner — either request is honoured on the day we receive it.
We do not circulate it outside the practice, we do not add you to a mailing list, and we do not pass it to anyone else. You are giving us personal information about yourself in confidence, and the standard we apply to it is the one we would assess a client against.
A CV and a paragraph on what you would want to work on. No forms, and no application portal.
Recognised this quarter
Amelia Johnson
Cyber Security Analyst
Amelia has spent the quarter on an engagement in the security X-ray screening sector, where the equipment that finds what should not be in a bag has itself become something worth attacking. Her work has run across the full arc: research into the threat picture, secure DevOps practice for the software that drives the scanners, implementation and testing of the controls, and the governance record that lets a board show all of it was done properly.
The client’s feedback on the work was as good as we get, and we are grateful for it. Recognition of this sort is earned by the person, and it reflects how the practice works: one named analyst, accountable for the finding, staying with the engagement until it is done.
Away from the work, Amelia is a runner. Colleagues will confirm she arrives on foot on any day the Met Office is prepared to call dry, holds firm views on the reliability of that forecast, and has been known to describe a client’s control set as “a nice steady 10k rather than a sprint”. Her trainers live under the desk. Nobody has asked what happens if it rains after she has set off.
The award is £500 in hotel vouchers. We expect them to be spent somewhere with a good route out of the front door at seven in the morning.
There is no charge for the first conversation and no obligation at the end of it.