I have spent 22 years building software that has to be safe, secure and demonstrably correct — and the last decade of that working out how organizations can achieve those things without drowning in process.
Safionyx is where I do that independently.
What I bring to an engagement
Assessment authority. INTACS Principal Assessor for Automotive SPICE since 2014, with the Security Extension since 2022. Principal is the highest level in the scheme, and it is what allows an assessment result to carry weight with your customer.
Line responsibility, not just advice. Until 2025 I was Director for Quality, Functional Safety, Cybersecurity and Open Source at Elektrobit, a global automotive software supplier, and a member of the product development management team. I led expert teams of more than 60 engineers across several countries and was accountable for those four disciplines across the product portfolio. I have had to make these decisions with a budget and a delivery date attached, not only recommend them.
Engineering depth underneath. Before that I was a software architect and engineer — AUTOSAR, cryptographic software, verification. I read code, and I can tell the difference between a process problem and an architecture problem.
A view from inside the standards. Program Committee member at EuroSPI and at VDA Automotive SYS, member of the Soqrates expert group and of ASQF e.V. Long-standing involvement in the working groups behind MISRA C, ISO 26262 and INTACS.
Career
Safionyx GmbH & Co. KG — Founder and Principal Consultant, since 2025
Elektrobit — 2003 to 2025
Director, Head of Quality, Functional Safety, Cybersecurity and Open Source (2019–2025) Built the organization’s cybersecurity compliance capability through the introduction of ISO/SAE 21434 and UNECE R155. Established open source strategy and compliance governance. Member of the product development management team.
Chief Expert, Head of Software Systems Engineering (2015–2018) Laid the technical foundation for one of the first automotive high-performance computing platforms — the software-defined vehicle architecture in series production at a major OEM since 2019, with millions of vehicles on the road.
Team Lead, Quality and Safety Management (2011–2015) Led the central expert team for architecture, quality and functional safety. Active in the MISRA C, ISO 26262 and INTACS working groups.
Quality Manager and Project Manager (2008–2011), Software Architect (2005–2008), Software Engineer (2003–2005) AUTOSAR development and verification, cryptographic software, and the introduction of quality management methods for safety-critical products.
SUSE — Software Engineer, 2000 to 2003 Linux distribution engineering. Where a long-standing interest in open source licensing began — now part of my ISO 5230 and OpenChain practice.
Certifications
- INTACS Principal Assessor, Automotive SPICE (VDA QMC / INTACS)
- INTACS Automotive SPICE Security Extension
- Certified Automotive Cybersecurity Manager
- Certified Automotive Cybersecurity Engineer
- ECQA Certified Functional Safety Manager (SafEur)
- ECQA Certified Automotive Quality Manager
Publications and speaking
More than 50 papers, articles and conference contributions on functional safety, automotive cybersecurity, process assessment and open source compliance — published with Springer, Wiley, Elsevier, SAE and ASQ, and presented at EuroSPI, VDA Automotive SYS, SAFECOMP, Safetronic, embedded world and the ESE Kongress.
Recent work includes multilevel TARA methodology, Automotive SPICE for Cybersecurity and MAN.7, and the organizational demands that ISO/SAE 21434 places on automotive companies.
Education
University of Cambridge — Master of Science, Part III Mathematics University of Erlangen-Nuremberg — Diploma, Mathematics and Computer Science Ashridge Executive Education, Hult International Business School — Organizational Leadership
What I actually believe
Compliance and good engineering are not opposites. Every organization I have worked with that treated a standard as a documentation exercise produced worse software and more paperwork than the one that treated it as an engineering discipline.
What makes organizations succeed is the balance of people, product, process and culture. Not another binder.
I was trained as a mathematician and I still think like one: find the structure, remove what is not load-bearing, and be honest about what has actually been proven.
Get in touch
Based in Karlsruhe, working across Europe and internationally. Engagements in German or English, remote or on site.
alexander.much@safionyx.com | LinkedIn