Security & Engineering Leadership Consultant.
Hi, I’m Moreton.
I am an engineering and security leader. The work I take on is Head of Engineering, CTO, and CISO: covering the role for a defined period, or helping you see the organisation clearly enough to decide what to do next.
The aim is the same either way: a function the business can run, security it can stand behind in an audit or a partner review, and teams that still work after a difficult period.
I stay close enough to the detail to solve real problems, and far enough back to choose the work that actually moves the customer and the business. I run the function, not a slide deck: hiring, budget, suppliers, audits, and the conversation with the board.
Most of my career has been engineering and security leadership: ten years of line management, five as a senior manager, and organisations of around sixty engineers. I have been acting Head of Engineering at the Office of the Public Guardian, and I have covered Head of Security Architecture and Head of Security Operations at NewDay through a CISO change and a major commercial partnership.
The engineering side has been building the function, not only running delivery. That has included rebuilding seven multidisciplinary teams after a near-complete change of staff; introducing lead engineers and training new line managers; labour strategy and pay; and communities of practice for testing, security, and accessibility. Earlier I led the platform that generated almost all of a company’s revenue: high-throughput APIs, 24/7 messaging at scale, and more than 30% year-on-year growth.
The security side has been application security and security architecture that engineering can operate. Typical work has been PCI DSS (including PCI 4), ISO 27001, SOC 2, GDPR, and government assurance; partner programmes with multiple penetration-testing phases; embedding security metrics in engineering KPIs; and rolling tooling across dozens of teams. At NewDay that included an 86% reduction in tooling alerts, DAST across 45 engineering teams, and security assurance on a £100m+ partnership. Significant strategic risk goes to the board with evidence, not theatre.
That includes covering senior roles (CISO, CTO, Head of Engineering / Security) and shorter, focused work across security and engineering: assessments, organising penetration-testing programmes, and targeted advisory. The current offer is on the Services page.
Alongside the day job I co-founded DDD East Midlands Conference and spent several years helping run it. I have spoken at NDC London and served on its speaker selection committee.
The best way to reach me is a direct message on LinkedIn.
For a piece of work, the Services page is the best overview of what is on offer.
Security @ AWS
Moreton is a rare kind of engineering leader: technically strong, managerially disciplined, and genuinely empathetic. He makes decisions from a big-picture view, stays connected to the detail and the data, and will push back when it is better for the customer and the business. He takes management seriously as a craft, builds high-performing teams, and creates space for people to grow.
Senior Principal Security Architect
Working with Moreton was a highlight of my career. He combines exceptional interpersonal skill with deep expertise in security architecture and application security, communicating complex ideas clearly and offering pragmatic solutions to real risk. He leads with resilience and openness, and I am confident he will continue to make a significant impact wherever he goes.