An engineer who can carry the audit — not an auditor who talks about engineering.
JF Analytics is Frank Moore. Ten years building security into real environments, with the certification record to prove the paperwork side works too.
Ten years building it. Two years certifying it.
I started as a cyber auditor at the Department of Defense Office of the Inspector General, running full-scope assessments across military networks and interviewing CISOs and CIOs about why their programs weren't working. That's an unusual place to begin, and it shaped everything since: I know what an auditor is actually looking for, because I was one.
From there I moved into the risk management framework world. I worked as a cybersecurity specialist and information system security officer building ATO packages for a range of systems. That led me right into the build side — information system security engineering, then enterprise security architecture. I've run continuous monitoring across 20+ geographically separated networks and 5,000+ endpoints, migrated entire cybersecurity toolsets into AWS and Azure without dropping coverage, and automated away hundreds of hours of recurring operational work a year through toolset integration, scripting, and process improvement.
More recently I've spent my time on the thing most small companies dread: taking a compliance program from unowned to certified. An ISO 27001:2022 transition delivered with zero nonconformities — run alongside an ISO 20000-1 service management system as an integrated program, which is a materially harder job than either standard alone. And a SOC 2 Type II program built from nothing at a company that had never had a security function.
Here's the honest part: compliance is not my favorite work. Engineering is. But the two are the same job when you do it properly — a control is a thing you build, not a paragraph you write. SSO rollouts, logging pipelines, infrastructure as code, access automation. The framework just tells you which ones matter and gives a CFO a reason to fund them.
Which is also why I'd rather automate myself out of your environment than settle in. Before any of it, I served in the U.S. Air Force. I hold an M.S. in Cybersecurity and Information Assurance and a CISSP — and, before either, a B.S. in Accounting, which is less of a detour than it sounds. SOC 2 is an attestation standard written by accountants and performed by CPAs. Materiality, evidence sufficiency, management representations, control testing — that is audit vocabulary, and I learned it before I learned to write Terraform.
Four things I won't compromise on.
Outcomes, not headcount
You're paying for a problem to be solved, not for a roster of titles on a slide. Fixed scope, fixed price, in writing.
Automation first
If a task can be automated without sacrificing quality, it should be. That time goes back to your team, permanently.
Plain communication
Straight answers about what's urgent, what can wait, and what it costs to fix. No framework jargon used as a smokescreen.
Designed to leave
Every engagement has an exit written into it. I'd rather automate the work away or hand it to your hire than become a line item you can't remove.
Commercial compliance is easier than what I trained on.
Most of my career was spent under the DoD Risk Management Framework — a control set and evidence standard considerably heavier than SOC 2 or ISO 27001, with assessors who show up in person and check. Working under that regime builds habits that transfer directly: every finding gets an owner and a milestone date, evidence gets captured when the work happens rather than reconstructed later, and nothing gets called done without proof it closed.
That's why a 90-day timeline is realistic. It isn't a shortcut — it's what happens when the process is run by someone who has done it under stricter conditions.