From Telenor to Munich: lessons from a cybersecurity career and the road to Secfix and UN1QUELY

In the second part of my conversation with Ivan Minić on the Pojačalo podcast, we talked about my professional path: from Telenor to Air Serbia, DevTech in Novi Sad and Munich, what each of those systems taught me, and how I finally became an entrepreneur. We also talked about the lessons of founding companies, and where anyone can start protecting what matters most.

From Telenor to Air Serbia

It was a long and thorny road. If I had to describe my career with one feeling, it would be the feeling of being far from the comfort zone, further and further until it turns into masochism, and then I step back just enough to keep feeling constant progress.

I got into Telenor through the government’s professional training programme for graduates and stayed on a fixed-term contract. But I felt I could do much more than was asked of me, and waiting for a permanent contract would only have bought me time.

Information security was still a complete unknown in Montenegro, so I made a CV, went to Infostud and found one single cybersecurity ad, for an information security manager at Air Serbia. For someone with almost two years in the field, plus bartending and waiting tables, it was a high position, but experts were so rare in our region that I was near the top of the competition.

The role existed because Etihad Airways, which then owned 49% of Air Serbia and had a 40-person cybersecurity team, wanted at least one security person in every airline in its group. My manager at Telenor, Slaviša, encouraged me to apply and told me that the position was very demanding but that it would cost me nothing to try.

Then I made a mistake that cost me for a long time. At Telenor I earned 500 euros net and lived like a king in Podgorica, so I thought double would make me a champion. I got the job, but I had done no research on living costs, and in Belgrade I had no money for food until the 20th of the month. I spent the first three months in total depression, because I was in a new city without friends and felt like an impostor among colleagues with 20–30 years of experience.

ISO 27001 and training people actually listen to

My main task was to implement ISO 27001, the international standard for information security, with a hundred-odd controls across people, process and technology. The requirement came from Abu Dhabi, and I learned the most at Etihad, where I travelled often and drilled everyone with questions. When the plane landed back in Belgrade, I had to implement it all and at least sound like I knew what I was talking about.

Implementing it with people was at times a nightmare. Security awareness training became mandatory for every new employee, and in waves for everyone else, adapted to each audience. That was where I saw how much soft skills matter, because all my technical knowledge means nothing if I cannot get the message across to someone who does not want to hear it. Some people told me they had worked like this for 30 years and asked who I was to come and preach to them.

The average employee cares more about their own security than about the company. So I started with perhaps the most precious thing on our phones, the photos and videos of our lives, and with what happens when ransomware wipes them out or someone steals your identity. Only at the end of the training did I show how to apply the same habits at work. By then I had their attention, and people started telling me about their own situations, which showed me the training was working. That is where my love of teaching was born, and by the time I left Air Serbia, several thousand people had gone through my training.

After an attack: transparency and responsibility

For a long time the problem felt far away, until it hit the state cadastre and people started asking what it meant for their title deeds. The public was told not to worry because everything was on paper, although people first needed to know what had happened and how big the damage was. To this day there is no public report, as with most incidents, and even the basics are missing:

• —Citizens do not know where to report a hacked account or stolen identity, or whether to call 122.
• —Hardly anyone knows whether there is a national CERT or whom IT people in companies should call.
• —Banks report incidents to the regulator as a checkbox exercise, and it is unclear who actually helps banks, telecoms and other critical infrastructure under attack.

No one can guarantee 100% security, not even the US military, yet one incident can mark a security expert’s career as a failure. A breach should be one more lesson, and the Uber case shows why this matters so much in our profession. The hackers demanded money to keep quiet, and the only correct approach would have been to admit the breach, investigate it and tell users what risk they were in, but the company tried to pay and cover it up. The CISO was eventually convicted, although the main owner of business risk is the CEO, and the case opened a debate about where responsibility should lie so that security experts stay motivated to do their job.

When it got comfortable, I moved on

At Air Serbia, advancement was slow and political, security was a checkbox pushed by Etihad, and once the project was done it soon went into maintenance mode. My badly negotiated salary meant patching things together from the first of the month to the first, so I moved to DevTech in Novi Sad as its internal cybersecurity expert. I found out later that most applicants for both jobs had been physical security people who saw only the word “security” in the title, including sixty doormen. This time I negotiated a better salary, although I probably low-balled again.

But the moment I felt comfortable in Belgrade, I felt cramped, and I knew I needed an environment harsh in every way. I searched LinkedIn across Europe and reached the final round at KPMG in Brussels, but the role was a bit junior and my whole salary would have gone on a flat. About a month after I started looking, I got the offer I was waiting for, in Munich. I had told no one I was looking, and only after I had signed the contract did I call my mother. It was maybe the hardest conversation of my career, because we are extremely close.

Germany: everything is measured

The move to Munich was even rougher than the one from Podgorica to Belgrade. In Germany there is a system for everything, and while the only question where I came from was whether we had delivered, there everything was measured, input, output and everything in between, and optimising processes was an obsession. At five o’clock you were dead to them, and they to you, until the next morning. The culture was also cold, so my only friends there were Turks, Arabs and people from the Balkans.

My first company was HolidayCheck, practically the booking.com of the DACH region, with millions of users and their addresses and credit cards. Protecting all of that was a nightmare, and it was also a top-class system to learn from. My job was to keep the software from being vulnerable, from the whiteboard to the sprints. I had no idea that words like scrum, agile and lean even existed, so I learned them on the go.

The job of a security expert becomes a job of social skills. When an executive points at you and asks what you think, you have to say something smart that becomes an action point in tomorrow’s sprint. In risk assessment, you sit down with the director of the whole cloud department and pull out, as if with pliers, what keeps them awake at night. People have to feel supported by you, so you are the one who puts an arm around them and says that this is a problem we have to solve together, systemically, because it is a “help me help you” situation.

When an attack does get through, you need an incident management process that works like insurance. It defines who the key people are, how to reach them and who can read which logs, and you rehearse it in table-top exercises.

Kaia Health, the pandemic and two companies in a month

Germany gave me confidence and toughened me up. At Kaia Health, whose app worked like a physiotherapist at home, I was among the first ten employees, and the company grew to over 150 people while I was there. I sat next to the technical co-founder and pestered him with questions about running a startup. Every entrepreneur cuts their own path, though, so the point is to learn from all kinds of entrepreneurs and then build a model of your own. At Kaia I got the final push and decided that it was time.

The opportunity came with the pandemic, at a time when my then fiancée, now my wife Zorana, lived in Belgrade and we had planned for her to join me in Munich. Then everyone started working from home, and I spent three months with my mother in Bijela, where I decided to move to Zorana in Belgrade. When the borders opened, mine was the third or fourth car across that day.

In Belgrade, two stories came together at the same time. One was a cybersecurity services company in Novi Sad with two former colleagues from DevTech, which became UN1QUELY, a spin-off of the BrightMarbles group that gave us an office and its client base. It needed no investment, so it was a no-brainer. The other was Secfix in Munich, with completely different people, a pure B2B SaaS startup with 700,000 euros of initial capital from angel investors, where I was the salesperson, the product manager and the security expert. The two companies complement each other, with me as the only connecting point, and within a month I had started both.

Founder fit, a safety net and four companies

The product idea itself does not matter. If you cannot sell it, or have no one who can, you can write it off. And if there is vanity, a lack of transparency or competition between the founders, that is the cancer of a company from the day they come together. I met my Secfix co-founders, a woman from El Salvador and a man from Russia, through LinkedIn, so we had to put our cards on the table. I was planning a family, which for a young startup is a red flag, and we talked about it openly, because the fit between founders is the most important thing for a startup to succeed.

Moving from a salary to entrepreneurship, I made a safe bet. In my last months in Munich, alongside Kaia Health, I took a second full-time, fully remote job with an American company, purely for the cash. At one point I had three full-time commitments, and that meant I could sleep well even if everything fell apart, at a time when the wedding was booked and a child was on the way.

UN1QUELY had BrightMarbles behind it for up to two years, which was a completely fair deal for a spin-off, while a product startup gets new money only if it shows results in time. Secfix did, and a week before this conversation it had closed its Series A round. UN1QUELY went through hell in the meantime, like every software company I know. In the last two years I also started two new startups with grants from the Innovation Fund of Montenegro, one in automated penetration testing and my first B2C project in the pet industry, so today I have four companies on my table every day.

Ivan asked me why on earth I took all this on, and sometimes I ask myself the same. The biggest sacrifice was my social life, while my health stayed a priority, and what saved me was delegation. First I shot my ego three times, and every time it comes back I shoot it again, because it stops me from trusting others with the job. Whether they do it better than I would does not matter, since it will be good enough, and because I chose these people, it is my responsibility if they do badly.

Above all, back up your data

Start with what really has value for you, concretely your data. In companies we call this crown jewels discovery, because you find what is worth protecting and build the walls around it. Open your phone and laptop and check whether something you care about exists only on an old laptop that is slowly dying.

I keep all my photos and videos in three places, on Google Photos, Apple Photos and an external hard drive, because losing them would feel like losing a part of myself. This one habit covers 99% of what people worry about, which is losing the data that matters to them.

At work

• —Cloud backups run automatically, with hourly and daily snapshots. Check from time to time that they work.
• —Google Drive and OneDrive keep deleted files for 30, 60 or 90 days. Check how long, and copy what matters most elsewhere.
• —For customer data, use database replication, availability zones and an aggressive backup culture.

Once you have done that, ransomware can do nothing to you, even without an antivirus. That is why my advice is to solve your backups before anything else, as priorities one, two, three, four and five.

• Cybersecurity, children online and Skenify’s road to first place at AIM 2026RTV Herceg Novi
• Leaving Montenegro, lessons from abroad and coming home as an entrepreneurRTV Budva
• Online privacy, account theft, AI scams and what to do when you are targetedUdruženje za odgovorni i održivi razvoj
• The road to Secfix, Skenify’s pivot and leading startups with calm and transparencyScale SEE Podcast