Fractional CISO services

Who this is for

You're a growing SaaS company — roughly seed to Series C — and security has become a board topic, a sales blocker, or both. Enterprise prospects are sending security questionnaires. Investors are asking about your compliance posture. You need someone who has done this before, a few days a month, not a $300k+ full-time executive.

What a fractional CISO actually does

• Security strategy & roadmap. A prioritized, budget-aware plan tied to your actual risk — not a generic framework dump.
• Compliance ownership. SOC 2, ISO 27001, NIST CSF — gap assessment, control design, and audit readiness. Built on direct experience attaining and renewing ISO 27001.
• Customer & board facing. Security questionnaires, enterprise prospect calls, board reporting — the credibility layer that unblocks deals.
• Vendor & tooling decisions. What to buy, what to skip, and how to avoid three overlapping tools doing one job.
• Incident readiness. A response plan you'll actually use, with clear ownership before you need it.

How engagements work

Most engagements start with the CISSP-Led Security & Compliance Audit — a fixed-scope, fixed-price assessment that maps your gaps and produces a 90-day remediation plan. From there, ongoing fractional leadership runs on a monthly retainer sized to your stage: typically a few days per month for strategy, reviews, and customer-facing security work.

The first step is a free 30-minute call. We'll talk through where security is blocking you — deals, compliance, board questions — and whether a fractional model fits. If it doesn't, I'll tell you what does.

Why me

I'm a CISSP with 20+ years across security, identity, and enterprise SaaS — including attaining and renewing ISO 27001 at K2 and five years leading Americas TAM at Okta/Auth0, where security posture was a daily customer conversation across a $215M+ ARR book. I hold AWS Cloud Practitioner and AI Practitioner certifications, so cloud and AI security questions are in scope, not outsourced.