Virtual CISO
A virtual CISO for companies that have outgrown “we'll deal with security later” and are not ready for a full-time hire. By the hour, on a monthly retainer, or on a custom engagement shaped around duration and scope.
The work is mapped to the NIST Cybersecurity Framework, CISA's Cybersecurity Performance Goals, SOC 2, and ISO/IEC 27002. One set of controls, described in the language each of those asks for. I also work through due diligence: the questions, evidence, and gaps a customer, investor, or acquirer wants answered before they proceed.
Hourly and a monthly retainer are the usual shapes. A custom engagement is always an option when the duration and scope need to be defined for the work itself.
Call when something specific comes up. A risk assessment, a customer questionnaire, a cloud review, an incident, a code review, or a meeting with your auditor. Billed by the hour, scoped to that piece of work.
A predetermined number of hours each month. I act as your virtual CISO between the one-off projects: the roadmap, the metrics, vendor reviews, and a person your team already knows when something breaks.
Duration, scope, and the outcome are agreed for the work in front of you. It does not have to be a stack of hours or a standing monthly block.
Customers, auditors, and insurers rarely ask for the same document. The underlying work should still be done once.
Common pieces of an engagement, not a complete list of what I do. If what you need is not here, we define the duration and scope as a custom engagement.
Assess
A look at how the business actually runs: people, vendors, cloud, and the product. You get a sequenced plan for what to fix first, what can wait, and what does not need to change.
A small set of measures leadership can read: open risk, control coverage, time to fix, incidents, and training. The point is to show whether the program is reducing risk, not to fill a slide.
Identity, network exposure, logging, backups, encryption, and the defaults that ship wide open. Findings ranked by what an attacker, an auditor, or a customer would care about.
Audits, due diligence, and insurers
Control design, evidence, and the operating cadence a Type 2 exam looks for across the review period. I work with your auditor. I do not replace one.
Help completing the right Self-Assessment Questionnaire and the Attestation of Compliance that goes with it. This is the self-attestation path, for companies that are not in a QSA-led Report on Compliance.
Working through what a customer, investor, or acquirer asks: answers, evidence, and the gaps to close before you respond. A SIG, a CAIQ, or their own spreadsheet. Often the thing standing between you and the deal.
Help with the application and the controls carriers ask about: MFA, backups, privileged access, email security, and incident response. The form should match how you actually operate.
The ongoing program
The policies you will actually follow, mapped once to NIST CSF, CISA's goals, SOC 2, and ISO/IEC 27002. The next questionnaire reuses the map instead of starting over.
Which vendors touch sensitive data, what they owe you, and a review you can repeat. Includes the AI tools the team already turned on.
A short plan people can find at 2 a.m., and a tabletop so the first time you practice is not during a real incident.
What is exposed, what gets fixed first, and a record that it was fixed. The scan is the easy part. The program is the priority and the follow-through.
Who can get in, who still can after they left, and how admin access is granted. The control auditors and insurers both start with.
Whether you can actually restore, how long it would take, and whether backups are isolated from the accounts that would encrypt them.
People and the product
Short, specific training for the people who read email and click links. Phishing is still how most of these incidents start. Completion is one of the metrics on the dashboard.
The same idea for the people shipping code: secrets, dependencies, auth, data handling, and what “the AI wrote it” does not excuse.
A review of the paths that matter: authentication, authorization, data access, uploads, payments, and anything an AI agent generated that nobody re-read.
How models and tools are allowed to see company and customer data. Prompt injection, tool permissions, logging, retention, and the vendor terms that decide where that data goes.
Leadership
I can sit with a board of directors, an executive team, or investors and explain the program, the risk, and what changed. In their language, not a control spreadsheet.
Talks, briefings, and other engagements when you want a practitioner's point of view on security in front of customers, partners, or your own leadership.
You do not have a full-time CISO, and you do not need one yet. You do have a customer, an insurer, a board, or an auditor asking questions your developers should not have to answer alone.