Enabling success in regulated markets.

How I work

25+ years | Europe & the Middle East | Independent | English · German · Arabic

Amru Kotb

Independent advisory for regulated industries — from core to cloud.

HOW I WORK

I help from two directions: I help technology companies earn trust with regulated buyers, and I help leadership teams make better decisions about the technology and security they depend on.

For technology & SaaS companies selling into regulated markets

I've spent most of my career helping technology, cybersecurity, and cloud companies win and grow in banking, financial services, and government. I know what regulated buyers ask for, what makes them say no, and what it takes to earn trust.

Regulated market readiness

Getting your security and compliance positioning right for banks, payment processors, and government buyers. Due-diligence preparation, security questionnaires, and buyer-facing narrative.

Go-to-market strategy

Building a commercial approach for regulated industries that accounts for long sales cycles, multi-stakeholder decisions, and the partnerships you'll need.

Commercial strategy & partnerships

Identifying the right channel partners, structuring relationships, and building a strategy that works across borders — particularly in Europe and the Middle East.

For leadership teams in banks, payments & government

Technology and security decisions in regulated organisations are too important to leave entirely to technical teams — and too complex to manage without someone who understands both sides. I sit between the business and the technology function.

Strategic oversight of security & compliance

Helping boards and senior management ask the right questions about their security posture without needing to become technical experts.

Audit & regulatory preparation

Clarifying ownership, aligning stakeholders, and making sure the narrative holds together before auditors or regulators arrive.

Technology & vendor decisions

Evaluating cloud migrations, platforms, and vendor relationships through a commercial and risk lens.

Ongoing advisory (retainer)

A senior sparring partner for risk governance, change decisions, and "what should we do next?"

Fixed-scope engagements, ongoing advisory, or a mix. Always independent, transparent, and confidential.

Where I have existing commercial relationships that could create a conflict of interest, I disclose them upfront.

ABOUT

I've spent more than 25 years as a Managing Director, General Manager, and SVP Sales at Oracle, Giesecke & Devrient, Cryptomathic, Comforte AG, and Avery Dennison — selling cybersecurity, cloud, and identity solutions to banks, central banks, and government ministries across Europe and the Middle East.

This isn't my first advisory practice. Earlier in my career I advised international clients on market entry, M&A, and strategic partnerships — including investment roadmaps that generated €15M in first-year revenues.

I'm not a CISO and not a technical auditor. I translate between the people who build systems and the people accountable for them.

My career has taken me across four continents and every side of the table. What closes a deal in Frankfurt will not open a door in Riyadh. I rebuild commercial strategies from the buyer's perspective, every time.

I came into selling watching vendors perform rather than listen. The deals I am most proud of were won by genuinely understanding what the person across the table was carrying — their pressure, their risk, the colleagues they'd have to justify the decision to. When you do that, you stop selling and start helping.

"What Barclays wants does not necessarily mean the world wants it too."

The regulatory landscape is forcing decisions — now. DORA is in force. PCI DSS v4.0 deadlines have passed. NIS2 has expanded. The vendors that grow and the organisations that win are those that speak the language of compliance, trust, and accountability. That is the gap I work in.

CAREER HIGHLIGHTS

The deal everyone said was unwinnable Entered in third place behind the incumbent. Won the software deal and the full implementation.

Opening a market closed for a decade Inherited a territory the company had been attempting to crack for years. Rebuilt from the buyer's perspective. Secured reference accounts including S2M.

Winning sovereign deals against IBM, Deutsche Telekom, and Siemens Two major government technology programmes. Won both — on relationships, not price or brand.

Building a commercial function from scratch Excellent technology, no sales infrastructure. Built strategy, positioning, and pipeline from standing start. Live pipeline within weeks.

The leadership school experience builds Running a regional technology business across cultures that operate by completely different rules — and turning it into the market leader. The capabilities that builds are ones no classroom teaches and no standard consulting background provides.

Based in Munich. English · German · Arabic. Stanford GSB · Henley Business School · Cairo University.

TRACK RECORD

Selected examples from my career, anonymised. Confidentiality is non-negotiable.

Cybersecurity company — breaking into regulated markets

Built regional GTM strategy, repositioned for regulated buyers, prepared for due-diligence, secured enterprise accounts across banking, fintech, and government. Pipeline exceeded €2.5M.

Enterprise cloud provider — winning in financial services

Developed account-specific strategies translating platform capabilities into regulated buyer language. Led to landmark deals and new reference accounts.

Security solutions provider — commercial turnaround in EMEA

Repositioned from reactive vendor to proactive solutions provider. Revenues grew 50%, margins from 9% to 15%, market share quadrupled.

National identity programme — rescuing a €30M government mandate

Led relationship recovery for a contract serving 60M citizens. Rebuilt trust with senior ministry stakeholders. Mandate retained.

Industrial group — P&L turnaround and post-merger integration

Full P&L responsibility as GM. Directed €55M acquisition integration. Grew revenues 33% to €20M. Profitability restored six months ahead of schedule.

CLIENT FEEDBACK

What clients say

Representative anonymized feedback

“Provided exceptional clarity in a complex regulatory environment.”

Senior Compliance Manager

Financial Institution

“A trusted advisor who understands technology, cloud, and regulation.”

Head of Operations

Payment Processor

“His independent perspective strengthened our decision-making.”

CTO

Fintech Provider

“Consistently practical and business-oriented.”

Program Director

Technology Partner

FAQ

Common questions

Answers to questions about how I work, what to expect, and why advisory.

With a confidential conversation — usually 30–45 minutes. We clarify context, priorities, and constraints. If there's a fit, I propose a focused scope. No pressure, no sales process.

Most start with a focused engagement lasting two to four weeks. If the work is useful and there's more to do, we can move into ongoing advisory on a retainer basis.

Fixed-scope work is priced per engagement. Retainers are monthly with clear deliverables. Transparent upfront — no surprises.

Both. Most work is remote. For sensitive topics, workshops, or leadership sessions, I travel to your location.

All discussions and engagements are strictly confidential. I don't name clients or share specifics without explicit permission. Non-negotiable.

Because the most important security decisions aren't technical — they're business decisions. Who owns the risk? What does the board need to know? Will this hold up under regulatory scrutiny? These are the questions I've spent 25 years answering. When you need deep technical assessment, I'll tell you — and help you find the right people.

The problems I'm best at solving — earning trust with regulated buyers, bridging technical teams and leadership — don't need a full-time hire. They need someone who's been on both sides of the table.

CONTACT

Schedule a confidential consultation

Whether you're a technology company preparing to sell into regulated markets, or a leadership team that needs clearer visibility into security and technology decisions — I welcome a confidential first conversation.

WHAT TO EXPECT

  • 30–45 minutes, video call
  • We clarify context, priorities, and constraints
  • You leave with clear next steps

All discussions are strictly confidential.

or