Services
Scoped engagements or a standing advisory relationship. Everything below can be delivered standalone or as part of a broader program.
Security Program & Strategy
Build or mature a security program that fits your size, risk, and budget. Roadmaps, policies, control frameworks (NIST CSF, CIS, ISO 27001, SOC 2), and a vCISO option when you need leadership without the full-time hire.
Cloud Security
Architecture reviews and hardening for AWS, GCP, and Azure. Identity boundaries, network segmentation, logging, secrets, and infrastructure-as-code guardrails that hold up as you scale.
Application & Product Security
Threat modeling, secure design reviews, code review, and CI/CD hardening. I work alongside your engineers so security lands in the SDLC instead of at the end of it.
Attack & Penetration Testing
Web, API, cloud, and internal network testing with clear, prioritized remediation guidance. Findings you can act on, not a 200-page PDF.
Digital Identity
Identity and privileged access done from a risk perspective. SSO and MFA rollouts, least-privilege design, service-account cleanup, and access review processes.
Data Protection & Compliance
Locate sensitive data, decide who should touch it, and prove it. Readiness for SOC 2, ISO 27001, HIPAA, PCI, and customer security questionnaires.
Detection & Response
Logging strategy, SIEM tuning, alert design, and playbooks. Incident response planning and tabletop exercises so the first real incident isn't the first rehearsal.
Cyber Risk Quantification
Put numbers on risk so leadership can compare security spend against everything else competing for budget. Scenario modeling in plain business terms.
Not sure where to start?
A short security assessment is usually the right first step. You get a prioritized view of your biggest risks and a plan you can execute with or without me.
Book an assessment