I am Mikael Tsakmak, an information security consultant based in Greece, with about five years of experience in governance, risk and compliance. I lead security risk assessments and Business Impact Assessments aligned with the ITSRM2 methodology, and I act as the information security officer on EU and public sector projects. Before that, I audited IT general controls as part of annual financial audits. Under the name Tsakmak, I also design and build private, self-hosted tools with AI agents, and I review them as a security professional before they go live.
Security consulting and risk assessment. I run risk assessments from system scope to treatment, draft and update security plans and policies, and organise vulnerability assessments and penetration tests, then follow the remediation of the findings. I explain risk to project managers and stakeholders in plain language, and I run security awareness training for project staff and clients.
Secure, self-hosted tools built with AI. I build web and Android apps with AI agents, both local models and third party ones, and run them on my own server at my home in Greece, on hardware I manage myself. AI agents let me build, integrate and iterate fast. I set the requirements, review the result and own the security: the database is never exposed, containers run without root, security headers are strict, and there is no tracking.
I build for my own use first, and every tool is also how I learn a new technology. Security is a big part of my life, so I want to see how far one builder can go, and to show developers and teams, from real practice, that secure apps are feasible and that security is more than passing an audit.
Tsakmak is my studio. For about five years I have worked in information security: IT audit first, then risk assessments, security plans and project security on EU and public sector projects. Alongside that work, I build tools, for my own use first.
I like automating work so the next day is easier. If a job takes me 100 hours, and an app that takes 130 hours to build brings that job down to 10 hours, I build the app: the first time costs more, and every time after that costs only 10 hours. Building is also how I learn and try new technologies.
Information security is a big part of my life, so every tool is private, self-hosted on my own server in Greece, with no tracking and with security designed in from the start. I want to see how far one builder can go, and to show developers and teams, from real practice, that secure apps are feasible and that security is more than passing an audit.
Built with AI agents, reviewed by a security professional: that is how every tool here is made. AI agents, both local models and third party ones, make it faster to build, integrate and iterate. I set the requirements, review what ships and own the security. The result is a set of working tools, from a risk assessment tool aligned with the publicly available ITSRM2 methodology to a finance dashboard for Greek freelancers, and the same approach is what I bring to the organisations I work with.
The products run on my own server at my home in Greece, on hardware I manage myself, not on a SaaS platform. Traffic passes through Cloudflare for TLS and the tunnel.
Greek Freelancer Finance keeps its database on that server with no public port, and its encrypted daily backup is checked after each run.
The tools collect only what they need to work. No analytics, no ads and no third party scripts, and fonts come from my own server. This site has no cookies and no forms.
Marangos needs no login, stores nothing on the server, and its Content Security Policy allows only its own origin.
AI agents, local and third party, help me build, integrate and iterate fast. I set the requirements, review the result and own the security before anything goes live.
ITSRM2+ checks its calculation engine against golden test cases on every build, with a 100 percent branch coverage gate.
End to end security risk assessments and Business Impact Assessments aligned with the publicly available ITSRM2 methodology, with ISO 27005 as a reference. I guide asset owners through the valuation and gather the input the assessment needs.
Acting as the security officer of a project: organising vulnerability assessments and penetration tests, monitoring remediation, overseeing security measures and coordinating internal communication during a security incident.
ISO 27001:2022 Lead Auditor. I run gap reviews and internal audit work against the standard, building on two years of IT general controls audits, but I am not a certification body and cannot certify an organisation.
ISO 22301:2019 Lead Auditor. Business Impact Assessments are a regular part of my risk work, which links security risk to continuity planning.
Turning NIS2 and DORA ICT risk management requirements into concrete security measures, security plans and evidence an organisation can show.
Certified Data Privacy Manager (CDPM). I bring the GDPR view of security and accountability into risk assessments and into the design of the tools I build.
Using the NIST Cybersecurity Framework to structure security controls and to report maturity in a way that non-technical stakeholders can follow, with a clear before and after view.
Certified AI Security Specialist (CAISS), with ISO 42001 as the reference for AI management systems. I assess the risks AI systems bring and use local LLMs to support GRC work.
About five years in information security, from IT audit to risk management and project security. Employer and client names are left out on this page.
May 2023 to present
April 2021 to April 2023
Five certifications across security, privacy, audit, business continuity and AI security, and a BSc in Digital Systems with a focus on network and information security.
ISO 22301:2019 Lead Auditor
Certiprof, 2026
Certified AI Security Specialist (CAISS)
Ampcus Cyber, 2026
CompTIA Security+ (SY0-701)
CompTIA, 2025
Certified Data Privacy Manager (CDPM)
Ampcus Cyber, 2024
ISO 27001:2022 Lead Auditor
LRQA, 2024
BSc in Digital Systems, Network and Information Security
University of Piraeus, 2022
These are the tools I designed and built with AI agents, for my own use first. They run on my own server in Greece, and each page says clearly what is live, what is in development and what is planned. The newest live one is Job Tracker, my job search CRM at jobs.tsakmak.com, with passkey and TOTP sign in. The tools are not for sale or subscription: I plan to publish them as open source.
Security risk assessment aligned with ITSRM2, extended for AI and supply chain risks.
Web
Your myDATA invoices, income and tax estimates in one private, self-hosted view.
Web, Android
Test the invest-every-month advice against S&P 500 history since 1871.
Web
A private kanban for work and life, self-hosted in Greece instead of a SaaS cloud.
Web, Android
A private AI interior designer: one room photo in, redesigns out, no cloud.
Web (local only)
The recruiter calls. The application, the emails and the CV you sent are on screen.
Web
I take on freelance, business to business engagements: a risk assessment for a system or service, security and compliance support, help with self-hosted tools, or an AI agent workflow for your team. I work remotely and on site. My typical engagement runs for a year, fully dedicated to one company, and I am open to other formats.
Send me an email with a short description of what you need. There is no contact form on this site, so your message goes straight to my inbox.
I speak Greek and Turkish natively and work in English at a professional level.
Still under construction
The Tsakmak brand and this website are still being built, so some pages and details are not final yet. Thank you for your patience.