Tim Crouch
Founder and CTO of Global Software AI. CISSP since 2014.
Security has been my job for more than 35 years: ten in U.S. Army intelligence with a Top Secret clearance, then 25+ in IT building, running and defending security programmes, most of it in regulated financial services.
I ran GRC inside HSBC Trinkaus, Deutsche Bank and Commerzbank against BAIT, MaRisk, MiFID II, SWIFT and GDPR, and advised a licensed German investment management firm across its FinTech and TaxTech businesses. I co-founded a SaaS company and was its CISO and CTO through a nine-figure private-equity exit. Today I run Global Software AI from Riga, build CompylotAI, and take senior security engagements alongside it.
- 35+ years in security, 25+ in IT
- CISSP, ISC2, since 2014
- Riga, Latvia, working across Europe
- English (native), German and Russian (advanced)
- Banking, alternative investments, SaaS, retail, higher education
- B.S. Information Technology, Excelsior College
How I work
Project-based advisory is how I already work. A typical engagement has a clear scope, a fixed fee and a handover at the end. My most recent was a six-month post-acquisition security and GRC integration for a licensed German investment management firm, brought in by the CEO, delivered and handed back.
I'm hands-on. I have designed and stood up a SOC, built a full security programme in seven months, run penetration testing and remediation, and configured IAM, MFA, endpoint, SIEM and cloud controls myself.
I'm direct about what a control is worth, and I'll tell you when a requirement is optional.
Selected outcomes
- Sole CISO through a nine-figure private-equity exitWrote the policy set, ran the risk assessments and supported the buyer's security due diligence at Education Advanced.
- A security programme from scratch in seven monthsPolicies, endpoint protection, SIEM, IAM, MFA, forensics and vulnerability scanning at Sally Beauty Holdings.
- HSBC Germany's first cloud-hosted security serviceTaken through vendor due diligence, outsourcing risk assessment and regulatory approval.
- A local Security Operations CenterDesigned, built and connected to the European SOC in the UK to speed up incident response.
- Operating costs cut by more than 40%After a post-acquisition integration, turning the acquired division from a cost centre into a profit centre.
- PCI-DSS scope cut significantlyBy removing card data from enterprise systems and networks.
What I bring to an engagement
Security programmes, owned end to end
Strategy, roadmap, policy set, control framework, risk register, metrics and board reporting, as the accountable party rather than an advisor at arm's length.
Regulatory and framework readiness
ISO 27001 and SOC 2 through audit, GDPR, DORA, MiFID II, MaRisk, BAIT, SWIFT CSP, NIST CSF gap analysis and PCI-DSS scope reduction.
AI security and governance
Threat-modelling AI systems, data-residency design under GDPR and the EU AI Act, and training-data sourcing rules that hold up to scrutiny.
Third-party and outsourcing risk
Due diligence programmes, cloud and managed-service outsourcing assessments taken through regulatory approval, and security questionnaires from both sides of the table.
Security operations and incident response
SOC design and build-out, SIEM (QRadar, Splunk), cross-border incident coordination, forensics and tabletop exercises.
Identity, endpoint and cloud
IAM, MFA, privileged access, joiner-mover-leaver process, endpoint protection, and AWS and GCP control verification.
M&A security diligence
Sell-side preparation through a nine-figure private-equity exit, buy-side assessment of a target's posture and people, then the integration behind it.
Investment management, FinTech and TaxTech
Security, GRC and integration work for a licensed German investment management firm and its FinTech and TaxTech businesses.
Career
2025 to now
Founder and CTO
Global Software AI, Riga
- Building CompylotAI, AI-assisted compliance pre-checks for EU and German financial institutions covering GDPR, MaRisk and BAIT document review.
- Designed the EU and Swiss data-residency architecture so the platform holds up under GDPR and the EU AI Act.
- Built an AI-literacy curriculum and learning platform for executive and developer training.
2019 to 2020 and 2025
CTO and advisor
A licensed German investment management firm
- Advised the CEO and founder on technology, security and data handling across the firm's FinTech and TaxTech businesses.
- Returned in 2025 for a six-month engagement after the firm acquired a TaxTech company: assessed its security, GRC practices and people, then ran the integration.
- Cut the acquired division's operating costs by more than 40% and moved the team to AI-assisted development.
2016 to 2019
Independent cybersecurity and GRC consultant
HSBC Trinkaus, Deutsche Bank, Commerzbank, Frankfurt
- NIST Cybersecurity Framework gap analysis, and German point of contact for HSBC's global Cybersecurity Maturity Improvement Plan.
- Assessed 20+ security projects against GDPR, BAIT, MaRisk and SWIFT, and briefed Risk, Audit, Legal, Compliance and the Management Board.
- Designed and stood up a local Security Operations Center tied to the European SOC.
2014 to 2016
Director, Enterprise Technology, and Manager, Security Operations
Sally Beauty Holdings, Denton, Texas
- Built and ran a security programme from scratch in seven months.
- Delivered 75+ projects across a $4.6M budget, all under budget, with HA/DR designed in from day one.
2009 to 2021
Co-founder, CISO and CTO
Education Advanced, Tyler, Texas
- Co-founded a K-12 ed-tech SaaS company and ran technology and security through its nine-figure sale to a private-equity firm.
- Owned security for the multi-tenant platform: access control, encryption, logging, backup, the AWS migration, and penetration testing and remediation.
1997 to 2014
IT infrastructure and networking, rising to Director of IT
University of Notre Dame, University of Denver, University of Texas
- Infrastructure and networking roles at three universities, each culminating in a director position.
- At the University of Texas, ran security policy, infrastructure and compliance (PCI-DSS, HIPAA, FERPA) for a multi-campus university and its charter schools.
- Five years on the University of Texas System information security board.
2000 to 2005
Web support team leader, then IT Director
Compaq for GE Aircraft Engines, and Alford Auto Group
Where my security career started
From 1987 to 1997 I served as a U.S. Army intelligence interrogator, holding a Top Secret clearance and working in Russian and German. Security was the job: protecting information, assessing risk and reading people under pressure.
It's still the skill I use most on an incident call or in a vendor-risk negotiation: staying calm, asking the next question, and noticing what isn't being said.
Frameworks and tools
Regulation and frameworks
Platforms and controls
Read how I think about AI security
Plain-language summaries of NIST, OWASP, ISO/IEC 42001 and the EU AI Act, mapped to CISSP domains.