Security & compliance
For SaaS and AI companies selling to enterprise, financial-services and regulated customers. I help build security controls into the platform itself, so passing a security review comes from how you already operate, not a last-minute scramble.
When teams get in touch
Early on, security is a set of sensible habits. Then a larger customer sends a questionnaire, an auditor asks for evidence, or a penetration test comes back with findings. Suddenly you need clear answers, and the platform has to back them up.
I've worked in financial-services, enterprise and regulated environments where security, reliability and auditability are requirements. I bring the same approach to growing companies, at a proportionate scale.
The best security questionnaire answer is one your platform can prove.
warnAn enterprise prospect has sent a long security questionnaire, and the deal is waiting on the answers.
warnYou need SOC 2 or ISO 27001 to keep selling, and nobody has done it before.
warnA customer's security review or penetration test has turned up findings you need to fix properly.
warnNobody is fully confident who has access to production, or why.
warnAudit evidence is gathered by hand, in screenshots, the week before it's due.
warnThe board is asking what would happen after a ransomware attack or a major outage.
warnCustomers are asking how your AI features handle their data.
infoEach of these has a technical answer and an ownership answer. I help with both.
What I work on
Security and compliance fail when they're separate from engineering. Each area below is designed to work alongside the others and with the rest of your platform.
Controls built into the platform, so they hold without anyone having to remember them.
The technical side of ISO 27001, SOC 2, PCI and HIPAA, implemented for real, not written up as aspirations.
Answer enterprise security questions accurately and quickly, and keep the answers true.
A tested answer to "what happens if…" for ransomware, data loss and regional failure.
Clear ownership, a realistic roadmap and senior security leadership while you need it.
Treat AI systems as part of your security and compliance scope, not an exception to it.
Frameworks
The frameworks differ in scope and language. Underneath, most of the technical work is the same: controlled access, protected data, reliable logging, tested recovery and clear ownership. Done once and done properly, it serves more than one framework.
ISO 27001
Experience working on ISO 27001 programmes, covering ISMS scope, implementing controls in the platform, and producing the evidence an audit needs.
SOC 2
Getting the technical controls behind the Trust Services Criteria in place, with evidence the platform generates continuously instead of for one week a year.
PCI
Scoping and segmentation, so payment data sits in as small an environment as possible, with controls to match.
HIPAA
Technical safeguards for health data covering access control, encryption, audit logging and recovery.
I'm not an auditor, and I don't issue or sell certifications. I work alongside your auditor, compliance lead or compliance-automation tool to make sure the technical controls are real, and that the evidence stands up.
Approach
If a control matters, the platform should enforce it. Terraform, CI/CD checks and account guardrails beat a policy nobody reads.
When controls are automated, evidence is a query, not a project. The audit stops being a scramble.
A 20-person SaaS company doesn't need a bank's security programme. It needs the right controls for its customers, data and stage.
Security that slows every release gets worked around. The goal is a secure default path that's also the easy one.
Ways of working
Advisory
A focused review of your cloud environment and security practices against where you need to be, whether that's a framework, a customer's requirements or your own risk appetite.
Typical outputs
Project
Hands-on implementation of the controls that are missing, working with your engineers so the result is owned, documented and maintained.
For example
Fractional
Ongoing security leadership, typically one or more days a week, until you're ready for a permanent hire. I can help define that role, too.
Often covers
Next step
Tell me what's being asked of you and where you think the gaps are. I'll tell you honestly what it will take.
No sales process. You'll hear back from me directly.