Finland · security ops · agent‑built
Cyber-security lead by day. Agent-assisted builder by night.
Projects
Small, finished products. The test is whether a tool is still in use once the novelty wears off, and most of these are.
Featured · browser game
A mobile-first pixel-art quiz game that teaches the rules of Finnish pesäpallo to kids and their parents. Player and umpire perspectives, age groups G–D, difficulty tiers that unlock as you improve. No login and no backend; progress lives in the browser, installable as a PWA.
Featured · web app + live broadcast
Synthetic Finnish commentary for junior pesäpallo, in two parts. The web app follows a live match and speaks the events as the score feed records them. The broadcast pipeline mixes the same voice over a live video stream and republishes it to YouTube, run from a phone through its own control app, the Ohjaamo: pick the game, create the broadcasts, start the relay, clean up afterwards. The hardest part was making the Finnish voice sound like a commentator instead of a railway announcement.
Voice assistant PWA
Realtime voice assistant for Home Assistant, built on the OpenAI Realtime API and WebRTC. Talks to the house through a gateway with a restricted schema and an explicit allowlist; the security work is the product.
Personal alpha
Self-hosted single-user finance tracker: imports, AI categorisation, pattern detection and a three-month forecast. No third party holds the history. Own hardware is the best hardware.
Home Assistant integration
Finnish library loans, due dates, holds, fines and renewals from Finna, surfaced in Home Assistant with support for multiple library accounts. Installs through HACS. Since the integration went live, overdue notices have dropped to zero.
About
I run security operations for a B2B managed service provider and lead the CSOC: vulnerability and breach investigation, security training, and advising client executives. Then I go home and build the automation myself. Most security tooling is bought off the shelf, but the tools our team relies on most are the ones we wrote ourselves.
Where I operate
Deep technical investigation, operational team leadership, and executive advisory, usually within the same week. The hard part is translating between those three audiences without losing detail.
0
Years leading security and CSOC teams
0
Person MSP behind the operations
0
AI tools I built, in production use
24/7
How the whole operation runs, every week of the year
By day
Vulnerability and breach investigation, 24/7 operations, and the unglamorous work of getting risk decisions made by the people who own the risk. I train teams and advise client leadership: the same finding, told two ways, without watering either down.
By night
Agent-assisted builds for smart-home, voice and Finnish-language tooling. Small tools for the home and the hobbies. The ones listed here survived past their first month of real use.
Shipped at work
Internal tools, described at a level I can talk about publicly. All four are in daily production use.
CSOC
Turned the repetitive part of business email compromise triage into a repeatable pipeline for the CSOC team: evidence collection and the first pass of the analysis, so analysts start where the judgement begins.
Reporting
Scan output to a client-ready report without an analyst retyping it. Analysts still own the findings. The tool handles the formatting.
ISO 27001
Risk entries and non-conformities routed, drafted and tracked automatically, so the management system stays current all year round, with no scramble before each audit.
No API available
The vendor offered no API, so the integration was built anyway. A missing interface just means the integration needs one extra layer.
Domains
An MSP seat is an unfair advantage: you see the day-to-day IT and security reality of dozens of companies at once.
Mid-size power companies (generation, distribution and retail) seen through MSP engagements. Core NIS2 territory, with the operational reality that comes with it.
NIS2
Mid-size industrial production: overhead door manufacturing, wood processing, waste management. OT and IT sharing a network and rarely a plan.
OT / IT
Renewed an entire IT landscape from the inside: property, tenancy and finance systems into one integrated SaaS stack, and directed the software vendor as the customer.
From the inside
The MSP business itself, plus software product companies. Dozens of client environments show quickly which practices survive daily use.
MSP
Method
Agent-assisted work still needs structure. Speed is only useful when it repeats.
Plan first, so the implementation path is explicit before any code moves.
Test-driven where it catches regressions early and helps define the seams.
Automated code review and security review stay in the default path, never opt-in.
PowerShell and Bash automation underneath, so the workflow survives being handed over.
The output has to be maintainable by a human first, however AI-assisted the loop was.
Radical simplification that works around the constraint. In a previous role the apartment offer process ran for weeks because digital signing only worked in one country. Replacing the signature with a small card payment made it work globally and cut the process to under a day.
The interesting problem was the constraint; the payment was just a way around it.
This site
The page you are reading is also a work sample. This is how it goes from an idea to production.
01Source
The whole site lives in a private repo: content, styles, tests and deployment config in one reviewable history. Every change is a commit, nothing is edited in place.
02Design
The look was iterated as a high-fidelity prototype in Claude Design: tokens, typography, spacing and copy locked before a single line of production code existed.
03Production
Claude Code recreated the design in Astro; type checks, a test suite and the production build all run before anything lands on the branch.
04Deploy
Every push to the main branch builds and publishes on Cloudflare Pages automatically. No servers to log into, no deploy scripts to remember. The pipeline is the release process.
What ships is plain HTML, CSS and a few kilobytes of vanilla JavaScript. No backend, no database, no accounts, no cookies. Nothing is running that could be broken into, and the hosting lives outside my own house.
The site collects anonymous visit statistics with self-hosted analytics. There are no tracking cookies, individual visitors are not identified, and the data is never shared or sold.
The smallest attack surface is the code that does not exist.
Everything here was set up end-to-end by a Hermes agent working from the owner's instructions: domain registration and DNS, the GitHub repository, the Cloudflare Pages deployment, and the site itself. No step was done by hand.
