Tomas Persson

AI, security and privacy advisor

Ph.D.CISMCISACDPSEGreater Boston

I work with regulated organizations on AI, privacy and security, from international groups to small cloud- and AI-native companies. The work runs from security architecture and hands-on operations to management systems, strategy and board-level risk decisions.

I have been a CISO and data protection officer, and I trained as a scientist, with a Ph.D. in plant physiology. Much of my work has been with pharma, medtech, healthcare and other life-science organizations.

Portrait of Tomas Persson

Expertise

  • Privacy and data protection

    Data protection officer for two organizations, one of them handling biometric data, and hands-on privacy work in healthcare and university research. Privacy management systems on ISO 27701, and compliance with GDPR, CCPA and China's PIPL.

  • AI governance and third-party risk

    Governing how AI systems, external models and suppliers use sensitive data and intellectual property, with ISO/IEC 42001 as the framework. Advisor to companies building AI-native security tools.

  • Security architecture and operations

    Secure operations designed and run for large groups and small companies alike, built on cloud services (SaaS, PaaS, IaaS) and AI. Practical technical controls, and replacing weak ones where security debt has built up.

  • Identity and access

    Identity governance and administration, identity provider integration and access control, including identity for AI agents and other non-human accounts.

  • Information security management

    More than 13 ISO 27001 programs, many covering several subsidiaries of an international group, and several certified with no non-conformities. SOC 2 readiness and security leadership as a CISO.

  • Risk assessment and audit

    Assessments against the NIST Cybersecurity Framework, enterprise risk frameworks on ISO 31000, and audit readiness from a certified auditor's side of the table.

  • Business continuity and resilience

    Continuity programs on ISO 22301, incident and crisis preparedness, tabletop exercises, and operational resilience under the EU's DORA.

  • Regulated products and life sciences

    Security programs for pharmaceutical organizations, and medical-device risk management under ISO 14971 and the EU Medical Device Regulation.

Experience

  1. 2020 – present

    Senior Lead Consultant · Omegapoint

    Security, risk and compliance programs for organizations in pharma, medtech, healthcare, finance and software across Europe.

  2. 2021 – 2025

    Chief Information Security Officer · Omegapoint

    Owned security, privacy, risk and continuity for a cybersecurity firm of more than 900 people, including its ISO 27001 certification. Also data protection officer for its Norwegian company.

  3. 2018 – 2020

    Global Security and Privacy Officer · Attendo

    Built the group's security management system from the ground up for a Nordic healthcare provider with more than 20,000 employees in four countries.

  4. 2012 – 2018

    Information Systems Manager · Stockholm University

    IT, security and data protection for a large research department.

Fields

Industries

  • Pharma
  • Medtech
  • Life sciences
  • Healthcare
  • Financial services
  • Software and SaaS
  • Manufacturing

Technical

  • Security architecture
  • Cloud security
  • Identity governance
  • Access management
  • AI agent identity
  • OT security
  • Python and R

Regulations

  • GDPR
  • CCPA
  • EU AI Act
  • Cyber Resilience Act
  • NIS2
  • DORA
  • EU MDR

Standards and frameworks

  • ISO/IEC 27001
  • ISO 27701
  • ISO/IEC 42001
  • SOC 2
  • NIST CSF
  • ISO 31000
  • ISO 22301
  • ISO 14971

Standards work and teaching

  • Member of ISO/IEC JTC 1/SC 27/WG 4, the international working group on security controls and services (since 2025), and of the Swedish committee for the ISO/IEC 27000 series (since 2022).
  • Lecturer on strategic cybersecurity for senior executives (since 2023).
  • Advisor to cybersecurity investors and founders.
  • Mentor with Minorities in Cybersecurity and Women4Cyber.

Education

  • Ph.D., Plant Physiology · Stockholm University
  • M.Sc., Horticulture · Swedish University of Agricultural Sciences and University of Copenhagen
  • Plant Science · Cornell University
  • CISM, CISA and CDPSE · ISACA

Contact

The best way to reach me is by email. I work in English and Swedish.

[email protected]