Most useful for plain-language cybersecurity explainers that orient beginners on ISO 27001, audits, privacy, and skills.
Best for
Cybersecurity training brands building beginner-friendly ISO 27001 and audit course explainers.
Not for
Endpoint or managed security vendors needing hands-on technical demos for experienced engineers.
Key takeaways
ISO 27001 security spans people, processes, suppliers, compliance, and continuity.
Audits include 17 types; security audit alone is a limitation.
Beginner roadmap measures progress by what a learner can do without a tutorial.
Check first: Confirm recent post-level results, audience demographics, and sponsorship terms before committing.
Main ideas
Security management is organizational, not just technical · An audit proves controls work; knowing only the security audit is a limitation · Beginners have a direction problem, not a resource problem
Marcel Velica shares practical cybersecurity explainers on LinkedIn.
The available posts cover ISO 27001, audits, beginner career learning, and everyday privacy.
The governance posts widen familiar topics: the ISO 27001 explainer presents security as a responsibility spanning people, processes, suppliers, compliance, and continuity, while the audit post places cybersecurity audits among 17 kinds of audit.
They also give beginners an ordered practice roadmap and use concrete situations—such as posting holiday plans while a home is empty—to make privacy risks easy to recognize.
These posts make them worth following for concise introductions to cybersecurity topics and clear starting points for further learning.
Velica’s distinctive strength in these posts is turning broad cybersecurity subjects into approachable, structured explanations.
The ISO 27001 post moves beyond firewalls to cover organizational responsibilities; the audit post uses a short taxonomy to show the wider context; and the beginner roadmap ends with a practical measure of progress: what a learner can do without a tutorial.
The privacy post is an exception to the list format: it builds its point through everyday examples and a direct reframe.
Across these different subjects, the writing favors plain language and usable orientation over detailed technical instruction.
Across four LinkedIn posts, Marcel Velica argues that security education should start with how an organization or a career works, not with tools.
Read more
Their recurring points: ISO 27001 is a management system spanning people, suppliers, and continuity, not a firewall checklist; audits prove controls work, and cybersecurity professionals need the wider audit map to work across GRC, IT, and risk; beginners need sequence, not more links, and should measure themselves by what they can do unaided; and everyday oversharing is a security topic worth confronting directly. Each post reframes a common assumption, then offers a compact numbered framework readers can save or act on.
Security management is organizational, not just technical
Marcel Velica’s ISO 27001 explainer rejects the assumption that the standard is “just about firewalls and encryption” and presents it as a system covering people, processes, technology, suppliers, compliance, and business continuity.
Read more
Its 14 areas include human resource security, supplier relationships, business continuity, and compliance, alongside cryptography and operations.
Security work, the post argues, is distributed across an organization rather than owned by a technical team.
The closing claim makes the position explicit: the standard is about building an organization where security is “owned, managed, measured, and continuously improved.”
The post names employee screening, secure onboarding and offboarding, and security awareness and training under human resource security — people-process items, not products. Under supplier relationships, it asks readers to manage SaaS providers, define security requirements in SLAs, and understand shared responsibilities.
An audit proves controls work; knowing only the security audit is a limitation
The companion post places the cybersecurity audit among 17 audit types, from bank, compliance, and financial audits to investigative, statutory, and tax audits.
Read more
The wider map, it argues, helps professionals work effectively across security, GRC, IT, risk, and compliance.
Its conclusion is direct: an audit is not just about finding problems but proving that controls and processes work as intended.
That shifts auditing’s purpose from detection to verification.
The list presents an integrated audit as combining financial, IT, compliance, and operational reviews in one engagement. It shows why a security specialist who recognizes only security audits would be underprepared for cross-functional work.
Beginners have a direction problem, not a resource problem
The entry-level post rejects the idea that new entrants need more material.
Read more
It describes the familiar cycle of switching among Python, hacking tutorials, and certification study, yet remaining unable to tackle a security challenge unaided.
The post diagnoses this as a sequencing failure.
Its remedy is an ordered seven-step path — fundamentals, guided labs, challenges, networking, web application security, specialty selection, and harder environments — each paired with a specific free destination.
It measures progress by capability, not consumption: what can you do without a tutorial?
Can you investigate a problem, explain a vulnerability, and identify a root cause?
The specialty-selection step offers four directions — Penetration Testing (pentesterlab.com), Bug Bounty (bugcrowd.com), Malware Analysis (malwareunicorn.org), and DFIR (dfir.training) — so readers choose a lane rather than collect every resource.
Personal oversharing is a security problem, and the fix is a habit rather than a tool
The privacy post drops the technical register and focuses on everyday social media behavior.
Read more
It connects four seemingly harmless disclosures — a holiday posted while the home is empty, screenshots with personal details still visible, career moves announced before they are official, and a visible daily routine — to one risk: someone with bad intentions can join the dots.
The problem, the post argues, is not social media itself but forgetting that not everyone watching has good intentions.
Its advice is practical, not prohibitive: keep sharing work, learning, and wins, but keep some things private.
The post ends by asking, “What’s one thing you never share publicly?” — turning the argument into a self-audit rather than a rule to accept.
A consistent teaching method: reframe first, then a saveable framework
All four posts follow the same shape, reflecting a clear priority for security education: name a likely misconception, offer a compact numbered or bulleted framework in plain language, then close with a save, reshare, or follow prompt.
Read more
The definitions are deliberately matched in length, so no item is elevated above the others. Readers can scan, keep, and reuse the material; a beginner ISO 27001 course could use the 14-area breakdown as a module map and the audit list as a glossary without reworking the structure.
The ISO 27001 post gives each of the 14 domains exactly three bullets, while the audit post gives each of the 17 types a single sentence. That lets readers compare items on equal footing rather than follow a hierarchy of importance.
A tension between “learn by doing” and teaching by reading
The roadmap argues that watching videos is not progress: practice in labs and challenges builds useful skill.
Read more
The other posts offer reading material — lists and definitions to save — rather than exercises to complete.
Both can be true: the material can advocate hands-on practice while being delivered as skimmable reference content.
For buyers, the practical question is whether Marcel Velica can provide worked problems, findings, or completed walkthroughs alongside these posts.
The roadmap urges readers to spend less time watching and more time in guided labs such as TryHackMe and challenges such as OverTheWire. Yet the post itself asks readers to save it for later rather than work through it.
To assess whether Marcel Velica can teach the standard underlying a beginner course, start here.
Read more
This post answers the question 'does this person explain ISO 27001 as something more than firewalls and encryption?' with a structure a curriculum can borrow.
The post opens by challenging a common beginner assumption — that ISO 27001 is about firewalls and encryption — then walks through 14 areas: information security policies, human resource security, access control, physical and environmental security, operations security, organisation of information security, asset management, cryptography, system development and maintenance, supplier relationships, communications security, business continuity management, compliance, and incident management.
Each area gets three short, plain-language lines, making the list a practical checklist.
Under human resource security, for example, the points are 'employee screening', 'secure onboarding and offboarding' and 'security awareness and training'.
The closing paragraph shifts from list to argument: the standard is about an organisation where security is 'owned, managed, measured, and continuously improved'.
The post then asks readers to reshare it and follow for more.
For brands planning a campaign
A beginner ISO 27001 course could use this 14-area breakdown as its module map, with three bullets per area shaping each lesson.
The post leaves out the practical material a training company would need to supply: risk assessment, evidence gathering, audit trails, and examples of findings.
A partnership could pair Marcel Velica’s overview of the standard with a partner’s processes and worked examples.
This post answers the question 'how much does Marcel Velica know about audits beyond security?' It is the most directly relevant original for a course on audit fundamentals, placing cybersecurity auditing within the wider audit landscape rather than treating it as a standalone topic.
Read more
The post makes one point and supports it with breadth: a cybersecurity audit is one of 17 audit types, listed alongside bank, compliance, external, financial, information systems, IT, integrated, internal, investigative, operational, payroll, performance, special, statutory, stock, and tax audits.
Each type gets a single sentence — 'Investigative Audit: Investigates fraud, misconduct, or suspicious activity' — making the post a glossary rather than an explanation.
The argument lands at the end: 'An audit isn't just about finding problems.
It's about proving that controls and processes actually work as intended.' The post finishes with a save prompt and a follow prompt.
For a course buyer, the post does not establish experience running a specific audit; ask for relevant examples.
For brands planning a campaign
The 17 types make a useful lesson-opening taxonomy for a course that places cybersecurity auditing within the broader audit world.
Their one-line definitions could readily become a glossary, quiz, or printable reference.
The post stops at definitions, so a training partner would need to add the material that makes a course practical: audit process, scoping, sampling, evidence, findings, and reporting.
Marcel Velica could orient beginners before the course goes deeper.
This is the clearest evidence of how Marcel Velica writes for beginners.
Read more
It answers the question 'what does this person think a new entrant should actually do first?' and shows the teaching method: reframe the problem, give ordered steps, then offer a way to check progress.
The post reframes the beginner's problem: 'Most beginners don't have a resource problem.
They have a direction problem,' illustrated by the familiar pattern of jumping between Python, hacking tutorials, and certification study.
It then gives seven steps, each with one or more named resources: basics (cybersecurityguide.org, hacker101.com), guided labs (tryhackme.com), challenges (overthewire.org), networking (cisco.com/learning), web application security (portswigger.net, owasp.org), specialisation (pentesterlab.com for penetration testing, bugcrowd.com for bug bounty, malwareunicorn.org for malware analysis, dfir.training for DFIR), and harder practice environments (hackthebox.com, vulnhub.com).
Specialisation is the only step split into options.
The post ends with a test rather than a promise: 'Don't measure progress by how much you've watched.
Measure it by what you can do without a tutorial.' The links are Marcel Velica's own recommendations; check that they remain current and suitable for the course.
For brands planning a campaign
The 'direction problem' framing and the without-a-tutorial test are strong opening moves for a beginner course's first module.
The seven-step progression — concepts, labs, challenges, networking, web security, specialisation, testing — is a curriculum outline in miniature.
The post focuses on skills and practice, not governance, so a governance-focused course would need to pair it with the ISO 27001 and audit posts.
This shows a second writing mode — short, persuasive, non-technical awareness content — useful if a course needs a security-awareness module alongside technical or governance lessons.
Read more
It answers the question 'can this person hold a general audience's attention on a soft topic?'
The post opens with a blunt claim, gives four concrete oversharing examples — posting a holiday while the home is empty, screenshots with personal details still visible, announcing career moves before they are official, and giving strangers a clear picture of a daily routine — then delivers the reframe: 'The problem isn't social media.
It's forgetting that not everyone watching has good intentions.' It closes by distinguishing what is safe to share from what is not, then asks, 'What's one thing you never share publicly?' and prompts readers to reshare.
Short paragraphs, one idea per line, and second-person address carry the argument.
The advice is general, with no statistics, cases, or sources cited.
For brands planning a campaign
This post offers a tone model for an awareness lesson or social-media privacy module: plain examples, no jargon, and a closing question that could prompt discussion or a course exercise.
It also extends a partnership beyond technical and governance topics.
A course would need to add policy, incident-response, and data-protection specifics.
ISO 27001 as an organization-wide management system, not a technical checklist1
The wider audit landscape, and where cybersecurity audits fit1
A beginner roadmap using free public resources to address a direction problem1
Personal privacy and oversharing as everyday security topics1
ISO 27001 as an organization-wide management system, not a technical checklist
Marcel Velica’s post on ISO 27001 walks through all 14 domains of the standard and pushes back on the assumption that it is “just about firewalls and encryption.”
Read more
It covers information security policies, human resource security, access control, physical and environmental security, operations, organization of information security, asset management, cryptography, system development and maintenance, supplier relationships, communications, business continuity, compliance, and incident management.
Each domain gets three short, plain-language bullet points.
The closing argument is that the standard is about building an organization “where security is owned, managed, measured, and continuously improved.”
A sequential numbered list, with one domain per block and three bullets each, written for readers with no prior exposure to the standard. The post closes with a reshare prompt for cybersecurity, GRC, and compliance readers.
For brands planning a campaign
This is ready-made scaffolding for an ISO 27001 beginner course.
A training partner can build modules directly on the 14-domain breakdown rather than commissioning new curriculum architecture.
The post’s framing gives the course its core message: compliance work is organizational, not just technical.
The wider audit landscape, and where cybersecurity audits fit
A companion listicle lays out 17 audit types, from bank, compliance, and cybersecurity audits through financial, integrated, internal, investigative, operational, payroll, performance, special, statutory, stock, and tax audits.
Read more
It argues that cybersecurity professionals who know only security audits are underskilled for cross-functional work: “An audit isn't just about finding problems.
It's about proving that controls and processes actually work as intended.”
The stated payoff is easier collaboration across security, GRC, IT, risk, and compliance.
Numbered definitions, one or two sentences apiece, kept to a consistent length so no audit type appears more important than another. Ends with a save-for-later prompt.
For brands planning a campaign
Useful as bridging content for a course that places ISO 27001 and security auditing in a wider governance context. It also identifies an audience the partner may not have targeted: people moving between security, IT audit, and compliance roles who need an orientation to the terminology before going deeper technically.
A beginner roadmap using free public resources to address a direction problem
The entry-level post argues that new learners do not lack resources; they lack direction.
Read more
They bounce between Python, hacking tutorials, and certification study, yet still cannot approach a security challenge alone.
The proposed fix is a seven-step path — fundamentals, guided labs, challenges, networking, web application security, specialty selection, then harder environments — with named free destinations such as TryHackMe, OverTheWire, PortSwigger, OWASP, PentesterLab, Bugcrowd, DFIR Training, HackTheBox, and VulnHub.
Progress is measured by what someone can do without a tutorial.
A diagnostic opening names the reader’s frustration before offering links, followed by a step-by-step sequence that pairs each action with a specific external resource.
For brands planning a campaign
This is the strongest single hook for a training company entering at the beginner end. The post handles demand framing and funnel work; a partner can build a paid or structured layer on top of a sequence learners have seen endorsed, or co-author an expanded version using the same step order.
Personal privacy and oversharing as everyday security topics
A shorter post drops the technical register and targets personal social media habits: posting holiday plans while the home is empty, sharing screenshots with visible personal details, announcing career moves before they are official, and revealing daily routines.
Read more
Its point is that someone with bad intentions can connect individually harmless disclosures, and that people can share their work without making their whole life public.
Four scannable scenario bullets lead into a reframe (“the problem isn't social media”), an affirmation of what readers may still share, and a direct question inviting comments.
For brands planning a campaign
Shows reach into security-awareness training for non-technical employees, a different buyer from the ISO 27001 and audit content. A partner selling awareness modules can treat this as evidence of tonal range; one selling only technical certification content should note that it does not match the brief.
Three positions recur across the posts: security is organizational rather than purely technical, breadth of context matters before depth of tooling, and learners need sequencing more than more links.
Read more
The format is consistent too — a numbered or bulleted framework, short plain-language definitions, an explicit reframe of a common misconception, and a closing save, reshare, or follow prompt. Every post funnels to the same follow action on LinkedIn.
For brands planning a campaign
The predictable format helps with campaign planning: a partner can brief a piece in the same structure and expect it to match the creator’s prior work. Sponsored integrations would need to fit inside a numbered framework rather than appear as standalone product posts.
None of the four posts mentions a client engagement, named employer, certification held, case study, or delivered training program.
Read more
The content consists of educational summaries based on public frameworks and free learning platforms; none of the four posts shows sponsorship, an affiliate arrangement, or a commercial offer. The posts also provide no dated history to assess change over time.
The four posts do not mention credentials, an employer, or sponsorship; that does not mean none exists elsewhere. Collecting profile, employer, or certification information would close the gap.
For brands planning a campaign
A partner should plan for a creator who explains frameworks clearly, rather than one whose content demonstrates lived implementation experience. Before contracting on the strength of practitioner credibility, ask for verification of credentials, current role, and any prior paid partnerships.
The reviewed LinkedIn posts document no sponsorship, affiliate, client, employment, investment, or ownership relationship between Marcel Velica and any brand.
Read more
They recommend third-party cybersecurity learning platforms—including TryHackMe, Hack The Box, PortSwigger, OWASP, Cisco Learning, OverTheWire, Hacker101, cybersecurityguide.org, PentesterLab, Bugcrowd, Malware Unicorn, DFIR Training, and VulnHub—as free or paid study resources for readers breaking into the field.
These are study recommendations in a career roadmap, not disclosed commercial partnerships; no post states a working or paid relationship with those platforms.
Ask Marcel Velica to confirm whether any other relationship exists.
Marcel Velica's reviewed LinkedIn posts are short, saveable cybersecurity explainers.
Read more
Start with the ISO 27001 breakdown for a plain-language view of the standard as an organization-wide management system, then the 17-audit list for how security work intersects with GRC, IT, risk, and compliance.
The seven-step beginner roadmap is the clearest entry point for someone choosing a learning path, while the privacy post applies the same teaching approach to everyday oversharing.
Across the four posts, the method is consistent: challenge a common assumption, lay out a numbered or bulleted framework in plain language, and close with a save, reshare, or follow prompt.
For a campaign requiring evidence of hands-on testing, named client work, or posting cadence, ask for examples and a dated posting history.
CybersecurityISO 27001Security auditsGovernance, risk and compliancePrivacy and oversharingCybersecurity careersCybersecurity educationSecurity complianceEducational listiclesNumbered frameworksCybersecurity beginnersSecurity and compliance professionalsGeneral professional audience
Both write about cybersecurity as a business and governance concern, not just a technical one.
Read more
Sandra Roberts connects security priorities to CISO and board-level decision-making; Marcel Velica translates standards, audits, and career paths into plain-language frameworks for practitioners and newcomers.
Sandra Roberts addresses executive strategy, continuity, and business value at the CISO and board level. Marcel Velica focuses more on orientation material: what a standard covers, what an audit proves, and how a beginner should sequence learning.
Both use numbered educational listicles to turn broad cybersecurity threats into readable, practical categories.
Read more
Each post gives readers a compact map they can save and reuse.
Michael Abtar organizes threat roundups by regulated industry, such as pharmaceuticals and financial services. Marcel Velica organizes material by standards, audit types, and career stages, with less sector-specific threat detail.
Both provide practical cybersecurity education for people building skills or doing security work.
Read more
Huzaifah S. names free tools and testing methods; Marcel Velica offers frameworks for compliance, audits, and beginner direction.
Huzaifah S. goes deeper into hands-on application security testing, including IDOR and access-control technique. Marcel Velica focuses on governance, standards, and learning orientation rather than walkthrough-level testing.
For a beginner-focused ISO 27001 and audits course, Marcel Velica merits a limited LinkedIn test, not a full launch on audience fit alone.
Read more
They had 83,734 LinkedIn followers on October 8, 2026, and four recent educational posts aimed at people starting in cybersecurity or studying governance, risk, and compliance: seven beginner steps with named labs and resources, an explanation of the 14 ISO 27001 domains, a list of 17 audit types, and a post on everyday privacy risk.
This content is geared toward learners and early-career practitioners, but follower count alone does not show whether they are course buyers or work in the functions a training company targets.
Ask for recent post-level results on ISO 27001, audit, and beginner-training topics—including impressions, saves, comments, link clicks, and any LinkedIn follower demographics or audience survey.
Then test a co-branded ISO 27001 explainer or audit-type carousel with a course registration call to action, and compare cost per qualified registration with the training company's other channels.
Marcel Velica's posts describe no sponsorship or partnership program.
Read more
The four posts are educational explainers and career guidance, each closing with a request to follow or reshare rather than offering a media kit, rate card, sponsored-format description or partnership inquiry route. Buyers would need to propose an arrangement directly and confirm the format, deliverables and terms with them.
A cybersecurity training company building a beginner-friendly ISO 27001 and audits course should treat Marcel Velica as a strong fit for the explanation layer.
Read more
The two governance posts are already shaped like course material.
The ISO 27001 post breaks all 14 domains into three plain-language lines each, mapping directly onto a module list and lesson shape.
Its opening move—rejecting the idea that the standard is just firewalls and encryption—gives the course a defensible core message: compliance work is organizational.
The audit post lists 17 audit types with a one-sentence definition each, ready to serve as an opening taxonomy, glossary, quiz, or printable reference.
The beginner roadmap shows the teaching method a first module needs: name the reader's frustration ("most beginners don't have a resource problem, they have a direction problem"), give ordered steps, then offer a way to check progress ("what you can do without a tutorial").
The privacy post shows the same voice working on non-technical material, useful if the course includes awareness content.
The split of labor is unusually clean: the posts leave out exactly what a training company sells—risk assessment, evidence gathering, audit trails, what a finding looks like, and reporting.
Velica supplies the framing and beginner entry point; the partner supplies process depth and worked examples.
Two points should guide the decision.
The audience section records 83,734 LinkedIn followers observed October 8, 2026, but provides no job roles, seniority, geography, or buyer composition; the posts also contain no engagement or click data.
Ask for audience demographics and post-level performance before forecasting results.
No post shows the creator delivering training, holding a certification, or running an audit, so the partner should not market the collaboration on practitioner credentials.
Start with one co-branded placement and a registration call to action, then compare cost per qualified registration against the partner's other channels before committing to a full series.
When to choose a specialist
An endpoint detection or managed security vendor seeking a creator to deliver an on-camera technical product walkthrough to experienced security engineers, presenting as a hands-on practitioner, has a materially different need.
Read more
Marcel Velica's posts do not support that.
They offer orientation-level writing assembled from public frameworks and free learning platforms: the 14 ISO 27001 areas, 17 audit types, a beginner pathway featuring TryHackMe, OverTheWire, PortSwigger, OWASP, HackTheBox and similar sites, and a general privacy piece with no statistics or cases.
None shows a tool being configured, an investigation being run, a control being tested, or a result being reported.
The posts name no employer, client, certification, or delivered engagement; they also include no video or audio to show whether the creator can carry a demo or hold an experienced technical audience on camera.
A vendor needing implementation proof, lab work, or a practitioner-to-practitioner conversation would be buying a skill set the posts do not demonstrate.
The commercial gap is just as large: the four posts publish no media kit, rate card, sponsored-format description, inquiry route, or post-level performance data, leaving no bookable format, published way to contact the creator for paid work, or basis for pricing and forecasting a placement.
Before signing, ask for recent tool or lab content, a current role or certification, any recorded video, post-level results, and details of available paid formats and contact arrangements.
The absence of this material may reflect the four-post sample rather than the creator's actual experience, and does not establish whether they accept paid work.
The same weakness would sink a training company seeking advanced hands-on labs rather than beginner instruction; hold that variant to the same test.
A worked campaign example
Worked angle for the training company: a four-week, three-post co-authored beginner sequence that doubles as the entry funnel for a new ISO 27001 and audits course.
Post one expands the existing 14-domain explainer, keeping its familiar three-lines-per-domain structure while the partner supplies a short worked example for three domains—what an access review actually produces, what a supplier assessment asks for, and what an incident report contains.
That moves the post from naming a control to showing its output.
Post two covers audit fundamentals, building on the 17 audit types, and ends with the partner's one-page “what a finding looks like” example, taking the list beyond definitions.
Post three reuses the roadmap's progress test—what can you do without a tutorial—and points to the course's first assessed exercise, with the creator framing why it is the right first step.
Each post links to a landing page mapped to the course module it introduces and carries one registration call to action.
Agree in writing on three creator-voice posts, three module landing pages, and a named instructor credit for Marcel Velica if the creator is willing to teach.
The partner owns the deep content, assessment design, and landing pages; the creator owns the framing and beginner entry point.
Before publishing, ask for post-level impressions, saves, comments, and link clicks to set a baseline; then track qualified registrations attributed to each post against the partner's other channels.
Extend to a full series or increase spend only after the first placement produces a defensible cost per qualified registration, and check follower demographics before increasing spend.
The posts publish no rate card, sponsorship format, or partnership inquiry route, so treat this as a proposal for the creator to confirm directly.
First validate whether the creator will be named as instructor, whether the LinkedIn posts are the whole publishing footprint, and whether they have training or audit delivery experience not shown in the posts.
Choose Sandra Roberts when a beginner ISO 27001 and audits course needs an executive-context module for CISOs, boards, and senior leadership.
Read more
The two posts argue that CISOs must translate security into business value, adapt to AI, govern data and privacy, build a security culture, and track regulation.
The quantum post adds a board-level continuity argument: CISO tenure is often short, so roadmaps need backing from longer-serving leadership.
For a course aimed at executives sponsoring an ISO 27001 program, that framing is closer to the buying conversation than Marcel Velica's domain-by-domain explainers.
Use Roberts to open with why leadership should fund and sustain the management system, then turn to Velica for the ISO 27001 domains and audit taxonomy.
Sandra Roberts' material offers executive commentary, not a beginner curriculum.
It does not break ISO 27001 into its 14 domains, define audit types, or lay out a teaching sequence; readers need governance knowledge to follow it.
The quantum post assumes familiarity with harvest-now-decrypt-later and CISO tenure, and neither post includes a worked exercise or glossary.
For a hands-on beginner course, Roberts can make the sponsorship case, but someone else will need to teach the core lessons.
Ask for evidence of training delivery and ISO 27001 audit experience.
Choose Michael Abtar when a course needs sector-specific risk examples to make ISO 27001 controls and audits concrete for pharmaceutical or financial-services learners.
Read more
The pharma post maps threats such as IP theft, ransomware, clinical-trial breaches, supply-chain weakness, connected medical devices, and biomedical espionage to mitigations including access control, encryption, audits, vendor assessment, segmentation, and training.
The financial-services post does the same for APTs, crypto risk, DDoS, insider trading, mobile banking, cloud, identity theft, AI abuse, and supply-chain attacks.
A training company building an ISO 27001 course for those regulated sectors could use these lists to show what a risk assessment is meant to catch and why audit evidence matters.
Velica explains the standard's structure; Abtar supplies sector scenarios for exercises.
These posts offer broad threat inventories, not ISO 27001 or audit instruction.
They list risks and controls but do not walk through a control objective, evidence request, finding, or corrective action.
Both use a repetitive format.
They date from 2024, so a 2026 course would need to check their currency.
The financial post also mixes fraud and market-abuse topics with cybersecurity threats, which can blur the scope of an ISO 27001 management-system lesson.
Abtar's material can strengthen case discussions in pharma or finance, but it will not replace Velica's domain map, audit taxonomy, or beginner roadmap.
Choose Huzaifah S. when a beginner course needs a practical application-security lab or a free-tool onboarding path, rather than an ISO 27001 and audit core.
Read more
The IDOR post gives a five-step authorization-testing method: map object types, look past numeric references, test secondary actions, validate privilege boundaries, and check bulk endpoints.
The free-tools post lists Hydra, Nmap, OpenVAS, Kali, Wireshark, PortSwigger, Burp Community, Metasploit, John the Ripper, OSINT Framework, Shodan, TryHackMe, and Hack The Box, and urges learners to start without paid courses.
A training company adding a hands-on access-control module to a beginner program could use that method and tool list as lab scaffolding.
Velica would still cover the ISO 27001 domains, audit types, and governance framing.
Huzaifah S. writes about offensive security testing and tool access, not ISO 27001 management systems or audit fundamentals.
The IDOR post assumes readers know authorization and API concepts; the tools post names software but does not teach beginners how to use it or sequence a curriculum.
Neither post addresses risk assessment, evidence, audit reporting, or compliance, so a course built around this creator would be an AppSec lab track, not the ISO 27001 and audits course the buyer asked for.
This is a narrow two-post sample; ask for evidence of course design and training delivery.
This profile rests on four complete LinkedIn posts by Marcel Velica: an explainer on the 14 areas of ISO 27001, a list of 17 audit types, a seven-step beginner cybersecurity roadmap, and a post on personal oversharing.
The follower figure is shown on October 8, 2026; no publication dates appear on the individual posts, so no change over time is claimed.
The similar-creator comparisons draw on LinkedIn posts by Sandra Roberts, Michael Abtar and Huzaifah S.
Marcel Velica's posts do not identify a signature book, show, business, employer, certification or delivered training or audit engagement, and no post-level engagement, click or conversion data, media kit, rate card or partnership inquiry route are published.
Where those gaps affect a decision they are named in the relevant section instead of being filled in.
The writing here describes the public educational work in these posts, not a full career or publication history.
