I take on a small number of advisory engagements alongside the research and writing on this site. The work sits where security architecture, infrastructure and compliance meet: the platform that has to pass SOC 2 or ISO 27001 this year, the PKI nobody trusts anymore, the AI platform heading to production before anyone threat-modeled it, the migration that cannot fail.
I’ve spent more than 20 years building and securing that layer. As a CTO I built a hosting company’s data center from scratch for 30,000 customers and roughly halved its infrastructure cost. I spent nine years on Cisco’s email security products across 32 data centers. Today I lead security and infrastructure architecture for cloud security SaaS platforms, including the controls behind their SOC 2 and ISO 27001 certifications. I also hold a Master of Laws, so the audit finding and the contract clause land on the same desk.
Security Architecture Review
A fixed-fee review of one platform, two to three weeks: cloud, Kubernetes, or AI inference and agents. I threat-model it (STRIDE, plus MITRE ATLAS and the OWASP Top 10 for LLM and Agentic applications where AI is involved), then review identity, keys and PKI, network and zero trust controls, the software and model supply chain, and detection.
You get a threat model your engineers can keep current, a prioritized findings register, a target architecture with a 90-day roadmap, and a two-page memo for leadership.
Audit Readiness and Compliance Engineering
For companies heading into SOC 2, ISO 27001 or PCI DSS, defense contractors preparing for NIST SP 800-171 and CMMC Level 2, and teams stuck on enterprise security questionnaires. A three-week diagnostic checks your controls against what an auditor will test, and against the security promises already sitting in your customer contracts and DPAs.
You get a findings register an engineer can execute without a translator, a map of contractual commitments against real controls, and a plan to automate the evidence. If you want, I then help build the controls and stay with you through the audit.
Trust Infrastructure
Scoped projects on the systems everything else depends on:
- PKI: an offline root, HSM or smart-card keys, certificate automation, and mTLS that is ready for shrinking certificate lifetimes.
- Email security: SPF, DKIM and DMARC to reject, MTA-STS, TLS-RPT and DANE, without losing legitimate mail.
- DNS security: DNSSEC, encrypted DNS and protective DNS.
- Zero trust and firewalls: segmentation, identity-aware access, and policy enforced in the data path.
- Migrations and multi-region: zero-downtime moves between data centers and clouds, with BGP and anycast failover.
Priced against the cost of getting it wrong.
Fractional Security Architect or CISO
Two retainers, each a monthly fee for a defined number of days:
- Fractional Security Architect: design reviews before things ship, threat models, the security architecture roadmap, and an engineer’s answer to the hard questions.
- Fractional CISO: everything in the architect retainer, plus the security program: the audit relationship, customer security questionnaires, DPAs worked alongside your counsel, and board reporting in plain language.
Hands-on when that is faster than delegating.
Who this is for
SaaS companies selling to enterprises, AI startups and platform teams putting AI into production, regulated fintech and health companies, and defense and government contractors. If your question is which endpoint agent to buy, I’m the wrong person. If it’s who signs, who’s liable, and whether the infrastructure can back the promise, that’s the work.
How engagements work
- A 30-minute call to see whether there’s a fit, at no charge.
- A written proposal within a few days: fixed scope, deliverables and fee.
- A mutual NDA before you share any detail of your environment.
- Remote first, on site when it matters.
Email [email protected], or send a message on LinkedIn: two lines on the problem and the deadline.