Security consulting for growing software companies

Pass enterprise security scrutiny. Without hiring a security team.

I help growing software companies (10 to 80 engineers) get deal-ready: security questionnaires answered in an afternoon, auditors met with evidence instead of scramble, and a clear view of the handful of risks that actually matter.

Book a 30-minute call Download the playbook

What good looks like, 90 days from now

Imagine the next enterprise security questionnaire lands on a Tuesday. By Thursday it is back with the customer, every answer true and evidenced. Nobody lost a week. Nobody guessed.

Reacting

A questionnaire lands and a week disappears
4,000 scanner findings nobody reads
Evidence assembled in a panic
Deals go quiet at the security review

Ready

Back with the customer in two days, every answer true
Five real risks, each with an owner and a date
Evidence generated by how you work
Sales says yes to the security review

✓

You know your real risks

Not 4,000 scanner findings. The five things that could actually hurt you, ranked by real-world exploitability, each with an owner and a date.

✓

Scanning runs itself

Code, dependencies, containers, secrets, and cloud posture are checked continuously in your existing CI/CD, tuned so engineers see signal, not noise.

✓

Findings have SLAs

Critical issues get acknowledged and fixed on a defined clock, with a waiver process for the exceptions. The same discipline enterprises run internally, sized for your team.

✓

Evidence exists before anyone asks

Scan reports, remediation records, access reviews: the proof an auditor or enterprise reviewer wants is generated by how you work, not assembled in a panic.

✓

Compliance stops being a mystery

You know exactly which SOC 2 / ISO 27001 controls you already satisfy, which are in progress, and what the path to audit-ready looks like, in plain language.

✓

Deals stop stalling on security

Sales can say yes to a security review instead of going quiet.

Sound familiar?

Most companies I work with look like this when we start: shipping fast, no dedicated security person, a scanner or two nobody reads (or none at all), and a founder who lost a week to the last security questionnaire and is not sure every answer was true. If a customer or auditor showed up tomorrow, it would be a scramble.

That is not negligence. It is what focus looks like at your stage. But there is a point where it starts costing you deals — and you are probably at it, or you would not be reading this.

The path

Three steps. Start small; each one stands on its own.

Security Snapshot

3 days · fixed price

Read-only access to your cloud and code. I bring the tooling; you need nothing installed and nothing purchased. You get a one-page brief: your top risks, what an enterprise reviewer would flag first, and what fixing it takes.

If you learn nothing you did not already know, you do not pay.

Enterprise-Readiness Assessment

2 weeks · fixed price

The full picture: every finding across code, dependencies, containers, secrets, identity, and cloud, deduplicated and prioritized by real-world exploitability (EPSS, CISA KEV) and your actual exposure, not raw severity scores. Delivered as a remediation plan sequenced into your sprints, a leadership walkthrough in plain business language, and hands-on help with any live security questionnaire. You keep the dashboard.

90-Day Readiness Program

90 days · monthly retainer

I install the machine: scanners wired into your CI/CD, SLAs and ownership running, control gaps closed, and your compliance platform (Sprinto, Vanta, or equivalent) stood up with evidence flowing. End state: audit-ready, review-ready, and a security practice your team runs without me.

Proof, not biography

For three years I built and ran the vulnerability management function at Boomi, a global SaaS integration platform: the scanning pipelines, the prioritization model, the SLA governance, the CI/CD security gates, the executive reporting. The same discipline enterprises use to protect thousands of customers — which means I have sat on the other side of the security reviews you are trying to pass. I know what the reviewer is looking for because I helped define it.

Before that: 20+ years in software engineering and leadership, including a decade at Misys building enterprise banking software and 8+ years consulting for organizations like Societe Generale, MetricStream, and Tala Mobile.

I am an engineer first. I do not hand you a PDF and leave. I fix things, build things, and teach your team to run them.

How I work

Read-only, always

Scoped, time-boxed access you revoke when we finish. I will remind you to revoke it.

Fixed scope, fixed price

No hourly meters, no surprise invoices.

Your data stays protected

Findings are handled as the sensitive data they are: encrypted in transit and at rest, deleted after the engagement.

No fear selling

I will tell you which risks matter and, just as clearly, which ones do not.