ISO 27001 Lead Auditor

For more than fifteen years she has managed information security, risk management and data privacy in international corporations in the Czech Republic and the United Kingdom, from electronics and energy to pharmaceuticals and the public sector. She headed service operations for the UK and Ireland, including business continuity plans and their testing, assessed the cyber security of global suppliers and designed and delivered cyber security risk management courses for UK government institutions based on the NCSC framework. She is a CISM, an ISO/IEC 27001 Lead Auditor and Lead Implementer and an ISO 22301 Business Continuity Manager, holds a Senior Executive MBA and is pursuing a PhD in information security at Royal Holloway, University of London. She speaks at international conferences (GISEC, #RISK, PrivSec, ISACA London) and at TAYLLORCOX she teaches ISO 27001, ISO 27005 Risk Manager and ISO 22301 with the perspective of a practitioner who does not just audit the standards but has implemented them in corporations herself. She teaches in Czech and English.

What is her course like?

She teaches ISO 27001 the way it is used in the boardroom and in IT: from risk analysis through the selection of controls to the evidence an auditor wants to see. She brings in cases from corporations, supply chains and the UK public sector, where she dealt with cyber risks for real, and leads participants to be able to defend the standard in front of their management and the certification body alike.

A graduate of the Czech Technical University in Prague. For more than six years she managed the management systems at České Radiokomunikace, where, as the company's only Lead Auditor, she led internal ISMS audits under ISO/IEC 27001, ISO/IEC 20000-1 and the Czech Cyber Security Act in an environment of electronic communications, digital infrastructure and cloud services with high demands on availability and regulatory compliance. In 2024 she single-handedly guided Cloud4Com to a successful ISO/IEC 27001 certification. At TAYLLORCOX she trains and audits ISO 27001, NIS2 and the new Czech Cyber Security Act: not only what the standard says, but how to implement it so that it stands up to the certification audit and to everyday operations.

For twenty years he worked where IT really breaks: he administered thousands of servers, designed networks for T-Mobile, built branch infrastructure from Ukraine to India and managed the migration of 60,000 computers for Société Générale. DHL contracted him into its security teams three times. He therefore knows ISO/IEC 27001 from both sides: as the infrastructure administrator whose door the audit knocks on, and as a certified Cyber Security Manager, Auditor and Architect under the Czech Cyber Security Act.

What is his course like?

He does not read the standard to you, he shows it in operation. He turns every Annex A control into a concrete setting: what access control that satisfies an auditor looks like, what logging you can actually investigate an incident from involves, and how to spot a backup nobody has ever restored. As a Certified Ethical Hacker and a Certified EC-Council Instructor he adds the attacker's view: why a given control is in the standard at all and what happens when it is missing.

On top of that, three things an online course cannot offer: teaching in Czech, groups of 7 to 12 people and dialogue. You can ask about situations from your own company and get an answer from someone who has most likely dealt with a similar one. He trains both technicians and company management, mainly in banking and telecommunications: he can present the same topic to server administrators and to the board's security committee alike.

Numbers instead of adjectives

• Thousands of trained graduates
• 5/5 average participant rating
• Since 2015 a TAYLLORCOX trainer
• 20 years of experience in IT operations and cyber security
• 98 %+ certification exam pass rate of his graduates
• 10 to 15 training days a month: teaching is not a side job but a craft