Add fractional security and technology leadership when your business needs it.

Security Program Leadership

We serve as your virtual CISO, owning the security program end to end. That includes writing and maintaining all security policies, conducting risk assessments, managing vulnerability scanning programs, and serving as the point of contact for auditors and assessors. We use industry-standard tooling including Vanta for automated evidence collection, Tenable Nessus for vulnerability management, and Bitdefender GravityZone for endpoint protection.

We also evaluate tools and practices for compliance gaps before they surface in an audit. When a new tool, workflow, or vendor is introduced, we assess its impact on your compliance posture and either provide a path forward or document the risk.

SOC 2 and HIPAA Compliance

We have direct experience leading SOC 2 Type II audits, including full 12-month observation windows covering Security, Availability, and Confidentiality trust service criteria, alongside HIPAA attestation. We've managed complete auditor transitions: evaluating and selecting new firms, negotiating engagement letters, and architecting calendar realignment strategies to ensure clean annual reporting periods.

We treat compliance as an operational discipline, not an annual scramble. Evidence collection, control testing, and audit prep are ongoing, not reactive.

Cloud Computing Infrastructure and Cost Management

We manage cloud infrastructure with an eye toward both security and cost. In one engagement we reduced Azure spend by 35% through environment audits, resource cleanup, and Reserved Instance optimization, while simultaneously improving the compliance posture. Infrastructure work covers SSL certificates, VNet flow logs (for compliance tooling integration), subnet cleanup, Key Vault migrations, and Active Directory hygiene including ghost object remediation and stale computer object cleanup.

We investigate infrastructure dependencies using KQL and Log Analytics before decommissioning shared resources, and have managed secure decommissioning of physical infrastructure including on-premises co-located server environments.

Endpoint Management and Device Security

Full device lifecycle management including Mac onboarding via Apple Business Manager, NinjaOne MDM enrollment, FileVault configuration, and automated Bitdefender deployment. We've managed RMM fleets, resolved MDM reporting discrepancies at the firmware level, and diagnosed Remote Desktop licensing failures under locked-down PowerShell environments using Event Viewer analysis.

Access Control and Least Privilege

Access control is where security policy meets operational reality. We implement role-based access control (RBAC) and enforce the Principle of Least Privilege across cloud environments, applications, and data systems. That means auditing who has access to what, why, and whether they still need it.

In HIPAA-regulated environments, this work is non-negotiable. We've conducted access reviews that surfaced significant violations, including cases where personnel with no legitimate need held access to protected health information, and corrected them with appropriate controls and documentation.

Vendor and MSP Management

We onboard, manage, and hold accountable your technology vendors. That includes negotiating contracts and SOWs, tracking deliverables and escalation utilization, identifying non-compliance that creates termination-for-cause leverage, and making replacement recommendations when vendors underperform. We've managed relationships with Vanta, Tenable, Bitdefender, NinjaOne, Duo MFA, and Azure managed services providers.

Documentation and Knowledge Management

Security programs fail when knowledge lives only in one person's head. We build documentation systems, not just documents. Infrastructure configuration logs, IT responsibility inventories with effort estimates and criticality ratings, compliance process documentation, and onboarding procedures. We've served as top-tier contributors to Notion-based knowledge bases in organizations where documentation was previously nonexistent.