A financial regulator
At the Financial Conduct Authority, defined security strategy and risk frameworks, and advised on regulatory alignment and architecture governance.
Ways to engage
One body of expertise. Four ways to put it to work.
Security GRC, security strategy and enterprise security architecture blueprints are what Sabsar does. How you engage depends on whether you need a defined deliverable, a senior leader or an independent voice.
Choose your model
Deliverable, leader or adviser.
Each model draws on all three practices. Every engagement starts with a proposal that sets out scope, timing and fees.
Defined deliverable
Fixed-scope engagement
A GRC framework, a security strategy or an architecture blueprint, delivered against a proposal that names the artefacts, the timing and the fee.
Best when: you know the decision you need to make.
Senior leadership
Virtual CISO
Part-time security leadership, accountable to your executive team. Owns the agenda, briefs the board and carries strategy and blueprint into delivery.
Best when: you need a security leader without a full-time hire, or cover while you recruit.
Independent voice
Executive advisory
A trusted adviser to chief executives, boards and committees on risk trade-offs, investment and the security side of major change.
Best when: a big decision needs independent challenge before it is made.
Delivery
Design authority and delivery leadership
A blueprint only pays back if it is what gets built. Sabsar can chair or support your design authority, assure suppliers' designs and lead security and architecture workstreams through delivery.
- Architecture review and assuranceDesigns checked against your principles and patterns, early enough to change course cheaply.
- Workstream leadershipCoordinate teams and suppliers, and resolve the decisions that hold secure delivery back.
- Progress at each gateReport delivery against the roadmap and adapt it when business priorities change.
How every engagement runs
Clarity in the advice. Discipline in the work.
The same five principles, whichever way you engage.
- Business-ledStart with objectives, critical services and the risk scenarios that matter to them.
- Technology-agnosticDirection first, tools second. No reseller ties and no product commissions.
- Evidence-awareWhat is known, what is assumed and what still needs testing are kept apart.
- Built for deliveryOwners, dependencies and decision gates are visible from the first day.
- Discreet by defaultClient names, findings and materials stay confidential. Nothing is shared without consent.
The principal
You work with the person who does the work.
Sabsar is led by A Shavandi, an independent enterprise security advisor. The work moves between the boardroom and delivery: making security clear to executives, and business priorities usable by the teams who build and run the controls.
Lead and chief security architecture roles across banking, regulation, government and telecoms, including Lloyds Banking Group, the Financial Conduct Authority, IBM Security, IAG GBS, BT and Prudential Financial.
Education: Cand. Scient. (MSc), Computer Technology, University of Southern Denmark.
Selected experience
All three practices, applied in demanding settings.
Responsibilities held in earlier roles. They describe the work, not measured outcomes or endorsements.
Enterprise cloud migration
Lead security consultant within programme pillars at Lloyds Banking Group for data and application migration to cloud, across risk, security architecture and assurance.
Major public and private programmes
Lead and chief architect roles with IBM Security across government, banking and telecoms, including health information access, banking separation, threat response and PKI.
Recommendations
In colleagues' and clients' words.
Excerpts from individual recommendations.
He takes an analytical approach to problem solving and simplifies complex security issues in order to engage with a wide audience.
His documentation of complex security design was lucid and relevant.
His expertise on the subject matter was invaluable.
Individual recommendations; they do not represent endorsements by the organisations named.