Cloud Security · DevSecOps · Compliance Readiness
I help startups and growing SMBs secure their AWS, Azure, and GCP environments and automate security controls, so you can scale safely, satisfy customer security requirements, and walk into SOC 2 or ISO 27K prepared.
Services
From a one-time posture review to ongoing security leadership. Pick the level of depth your stage demands.
For startups (10–200 people) and SMBs moving to the cloud.
Outcome: a clear, prioritized picture of your cloud risk, and exactly what to fix first.
Request a health checkFor engineering, DevOps, and platform teams.
Outcome: security becomes operational: integrated into your software delivery lifecycle, not bolted on.
Start a projectFor startups without a dedicated security leader.
Outcome: ongoing security leadership without the cost of a full-time security executive.
Discuss a retainerApproach
Every engagement follows the same principle: find the real risks, fix them in code, and leave your team able to run it without me.
01 · ASSESS
Hands-on review of your cloud accounts, pipelines, and configurations, mapped against CIS benchmarks, NIST 800, and OWASP. Findings come ranked by severity, not by checklist length.
02 · AUTOMATE
Remediations land as Infrastructure as Code, pipeline gates, and scripted guardrails, with AI skills applied where they add leverage, so fixes stay fixed and new infrastructure inherits secure defaults by design.
03 · OPERATE
Monitoring, logging, and documented processes that satisfy SOC 2 and ISO 27K auditors, and the security questionnaires your enterprise customers send.
About
I'm a security engineer with 10+ years across security engineering, penetration testing, and security leadership. I am currently a Senior Security Engineer at a healthcare technology company, where security and compliance aren't optional.
I've automated vulnerability management with LLM/AI tooling, implemented SIEM from open-source foundations, hardened infrastructure to CIS and STIG benchmarks, run VA/PT programs against networks and web applications, and led security teams through FedRAMP, HIPAA, SOC 2 Type 2, ISO 27K, and NIST 800 driven environments.
That mix matters for startups: I've been the person who finds the vulnerabilities, the person who fixes them, and the person who answers for them in front of auditors and enterprise customers.
Get started
A 30-minute call is enough to scope which engagement fits your stage. No pitch deck, no obligation. Tell me what you're working with and I'll get back to you within one business day.