Consulting
I take a small number of engagements through my Finnish consultancy. They range from email and a website for a small business to fractional infrastructure leadership for a mid-size firm.
Some numbers behind that: writing software since the mid-1990s; ~50 client businesses served through GoSoft; an ISO 27001-aligned ISMS written from scratch; ~2,000 hours operating the machinery this kind of software schedules.
Applied AI - RAG & LLM integration
Grounding language models in a company’s own documents and data - retrieval pipelines, not chatbot demos. I’ve built this in production, solo: hybrid search in plain PostgreSQL, embedding and reranking models self-hosted on CPU, streamed answers with tool calls, moderation, and the reporting around it. The write-up under Work has the latency and load-test numbers.
Fractional infrastructure leadership
Standing up or running IT for organisations too small for a department but too critical to improvise: identity, networking, servers, backups, vendor management.
ISO 27001
Writing an ISMS from a blank page - scope, risk assessment, policies, controls, and the records that show they run - as the person who writes them and configures them, not one who hands over a template pack. Certification itself is audited by an accredited body: I work as the implementer preparing for that, not as a substitute for it.
Architecture review
Operational and logistics systems, terminal operating systems included: integration boundaries, build-versus-buy, multi-tenancy, the parts that are expensive to get wrong.
Network design
Routing, wireless, and segmentation for industrial and logistics environments.
Email & web for small businesses
For companies that need email that reaches the inbox and a website that loads fast and stays up - without a stack of subscriptions to babysit. Domain, DNS, mail authentication and a site served from infrastructure you own, set up and documented so it can be handed over. This site and the mail behind it are the working example.
Self-hosted email
Corporate email on servers you own: migration off the big providers or alongside them, deliverability - SPF, DKIM, DMARC, reputation - transport security - DNSSEC, MTA-STS, DANE - spam filtering, archiving and retention. The mail behind this domain runs exactly this way, and every one of those records can be checked from outside; the hardening is written up in the essays.
How engagements are shaped
Four shapes cover most of what I take on. All of them end in something written down: a verbal handover is not a deliverable.
Email & web setup
Fixed scope, for small businesses: domain, DNS, email that reaches the inbox - authentication included - and a fast website on infrastructure you own, closed out with a handover document. Ongoing care after that is optional, not assumed.
Infrastructure assessment
A fixed-length review of what you are actually running - network, servers, identity, backups, and the operational habits around them. The deliverable is a written findings document: what is exposed, what is fragile, what to do first, and what each fix depends on. No retainer attached; you can hand it to someone else to execute.
ISO 27001 gap analysis
Fixed scope: your current state measured against the standard - the clause 4 to 10 management system as well as the Annex A controls, because that is where the findings come from - delivered as a gap report and a remediation list ordered by dependency. A Statement of Applicability derives from the risk assessment, so it is not a gap-report output; what the report gives you is what producing one would take. Worth doing whether or not you go on to certify.
Fractional retainer
A retainer with a stated monthly hour band, for organisations that need someone accountable for infrastructure decisions without hiring for it. Ongoing, and documented as it goes so the role stays handoverable.
I work directly, document as I go, and prefer owning an outcome to billing hours against someone else’s plan. Remote-first from Finland; on-site when the work is physical. Current availability is on the now page. Written references from earlier employers exist - one is quoted on the CV; references from current work sit under NDA. The engagements I can talk about publicly are written up under Work.
If your problem lives where operations meet software, write to me.