Illustration of a digital security shield
Services & Pricing

Fixed scope. Fixed price. Published up front.

Every engagement is scoped and priced in writing before it starts. Prices below are starting points for typical small and mid-sized environments — the number you get is the number you pay.

01 — VULNERABILITY MANAGEMENT

I don't just find them. I fix them.

Most vulnerability management engagements deliver a report. You get a spreadsheet with four thousand rows, a CVSS column, and a recommendation to “apply vendor patches” — then the same two people who were already underwater are expected to work it.

I come with the scanner. I scan. I patch. I reconfigure the device. I write the Ansible playbook that stops it recurring. I rescan to prove it closed. Reporting is a byproduct of the remediation, not the deliverable.

And then I stop. The managed phase exists to build the automation, not to sell you a seat forever. Once the recurring work runs itself, you move onto Auto-POA&M at a fraction of the monthly cost and I step out.

Foundation → managed → tool $6,500/month, falling About a week of my time each month at the start · drops as the automation lands · exit criteria in the SOW

The monthly is meant to go down. Early on this is roughly forty hours a month — running the cycle, validating findings, patching, writing the playbooks. As those playbooks take over, the hours fall and so does the invoice. A price that stayed flat for twelve months would mean I never automated anything.

Illustration of a verified security shield
Read this first

Scanning a broken environment produces broken results.

This is the part nobody tells you before selling you a scanner licence. If there's no asset inventory, no standard credentials across network devices, and no record of what lives where, then scanning cannot be done correctly — and no amount of tooling fixes that.

Uncredentialed scans against network hardware return findings nobody can validate. Half of them are guesses based on banner grabs. You end up arguing about whether a finding is real instead of fixing anything, and eventually somebody suggests just making the report look better. I've watched that happen. I won't run an engagement that way.

So every engagement starts with a foundation phase. It's real work, it's priced separately, and it's what makes everything after it mean something.

PHASE 0

Foundation

Asset inventory built and maintained automatically. Credentialed scanning access established across servers, endpoints, cloud, and network devices. Standardized device authentication — no more per-switch mystery passwords. Ownership assigned per asset class.

PHASE 1

Scan & validate

Credentialed scanning across infrastructure, endpoints, cloud, and network gear. Every finding validated before it reaches you — confirmed real, confirmed exploitable in your context, or dismissed with the reason written down.

PHASE 2

Fix & verify

Patching, reconfiguration, and hardening performed by me. Automation written so recurring classes of finding stop coming back. Rescan to confirm closure. Anything genuinely unpatchable gets documented compensating controls and segmentation, not a suppression rule.

What I do

  • Build and maintain the asset inventory the scanning depends on
  • Establish credentialed scan access across every asset class, including network devices
  • Apply patches and configuration fixes directly — servers, endpoints, cloud, network hardware
  • Prioritize by real exploitability and reachability in your environment, not raw CVSS
  • Write automation so the same finding class doesn't return next quarter
  • Document compensating controls where a system genuinely can't be patched
  • Rescan and verify closure, with evidence that doubles as audit evidence
  • Report posture trends over time, not point-in-time snapshots

What I won't do

  • Tune the scanner to make findings disappear from a report
  • Mark findings as false positives without validating and documenting why
  • Configure systems to evade detection rather than fix the underlying issue
  • Scan an environment with no asset inventory and call the output meaningful
  • Certify a posture I know isn't real

Making a finding vanish from a report and making a system safe are different jobs. Plenty of people will sell you the first one. If passing the scan is the actual goal, I'm the wrong hire — and I'll say so on the first call rather than three months in.

How this ends

Three stages, and the third one doesn't have me in it.

A vulnerability management retainer that never ends is a contractor seat with a different invoice on it. The point of the managed stage is to build the automation that makes the managed stage unnecessary.

STAGE 01

Foundation

Asset inventory built, credentialed scan access established across every asset class, device authentication standardized. Priced once, up front. Nothing downstream is trustworthy without it.

STAGE 02

Managed, while I automate

I run the program and fix the findings — and while doing it, I write the playbooks, the scan pipeline, and the reporting that replace me. You're paying for remediation and for the automation being built underneath it.

Months 1–3 · ~40 hrs/mo · $6,500
Months 4–9 · ~20 hrs/mo · $3,500
Then · tool licence only

STAGE 03

Tool handoff

The recurring work is automated and your POA&M generates itself from scan output. You keep a tool licence at a fraction of the monthly cost, I hand over the runbooks, and the retainer ends.

✓ The exit criteria go in the SOW on day one — not negotiated awkwardly a year later. Auto-POA&M is the tool this arc hands you.

Foundation phase

Asset inventory, credentialed access, and device authentication standardized. Required before managed scanning if the groundwork isn't there.

From $9,000 one-time

Network device hardening

Switch, router, and firewall baseline: SNMP, management plane, credentials, ACLs, and logging brought to a standard and held there.

From $7,500

Remediation sprint

You already have the findings and nobody free to work them. I clear the backlog and automate what recurs.

From $10,000
02 — ADVISORY RETAINER

Judgment on tap, without a project attached.

Some companies don't need an engagement. They need someone to call before they make a decision they'll be stuck with — which vendor to pick, whether a finding is actually urgent, how to answer the question the auditor just asked, whether the architecture a contractor proposed is sane.

That's not a project, and pricing it like one is why most people go without it and guess instead. This is the small version: a fixed block of hours each month, a direct line, and no minimum viable crisis required before you use it.

Fixed term $2,400/month 8 hours · six months · renews only if we both decide it should
Empty operations centre seats

What it covers

  • Decisions — tooling, architecture, vendor selection, build versus buy
  • Reviewing work somebody else is doing for you, before you sign off on it
  • Triage: which of these findings actually matters this week
  • Auditor questions, and how to answer them without over-committing
  • A read on scope and effort before you commit budget to anything
  • Policy and document review

What it isn't

  • Not implementation. If the answer is "someone has to build this," that's a separate scoped piece of work.
  • Not an on-call rotation. Reasonable response within a business day, not an incident hotline.
  • Not an assessment. I can tell you what I'd fix; I can't independently attest to work I helped shape.
  • Not a seat. Eight hours is eight hours — if it's consistently more, we should be talking about a different engagement.
✓ Six months, then a real decision. This does not auto-renew, and that is deliberate. At month five we sit down and establish whether you still need it — and if the honest answer is that your team has absorbed the judgment, I say so and it ends. A retainer that quietly bills forever is the thing I built this company to not be.
03 — COMPLIANCE & AUDIT READINESS

The Readiness Sprint

SOC 2 Type I and II, ISO 27001, ISO 20000-1, CMMC, and NIST 800-171 — delivered by someone who builds the controls rather than describing them. SSO deployed. Logging pipeline stood up. Terraform written. Segmentation implemented. Then the policies, the evidence pipeline, and the auditor relationship on top of it.

Two frameworks, two honest timelines. SOC 2 readiness genuinely fits in 90 days. ISO 27001 does not, because the standard's own audit structure prevents it — so it's priced and scheduled separately rather than squeezed into a number that sounds better.

✓ The guarantee: every control on the Readiness Criteria we sign at the end of Phase 1 implemented and evidenced by the agreed date — or I keep working free for up to 30 more days (45 for ISO). Excludes auditor scheduling and client-side delays; full terms below.
Abstract circuit diagram with a path resolving into a single forward arrow
Track A — SOC 2

SOC 2 readiness

90 days to audit-ready

Controls implemented, evidence flowing, auditor engaged. Type I can be examined right after. Type II then runs its observation window — typically 3 to 12 months, set by what your customers will accept, not by me.

Starting at $30,000 Fixed price · 90 days
Track B — ISO 27001

ISO 27001:2022 certification

5–6 months to certification

Scope, risk assessment, Statement of Applicability, full Annex A implementation, internal audit and management review, then Stage 1 and Stage 2 with the certification body. Industry range is 6 to 12 months; 5 to 6 is what focused execution and an engaged sponsor produce.

Starting at $45,000 Fixed price · 5–6 months
Track C — Both

SOC 2 + ISO 27001 together

6–7 months

Around 60% of the control work is shared between the two. Building both at once adds roughly a month over ISO alone and costs substantially less than running two separate engagements back to back.

Starting at $55,000 Fixed price · 6–7 months
Why ISO takes longer

It isn't more work. It's a structurally longer process.

Stage 1 — does it exist?

The certification body reviews your documentation: scope, risk assessment methodology and results, risk treatment plan, Statement of Applicability and whether your exclusions are defensible, and the mandatory Clause 4–10 records. It's a readiness verdict, not a pass or fail.

The gap — operating evidence

Stage 2 needs the ISMS to have actually been running, typically at least three months of it, plus time to close anything Stage 1 raised. Internal audit and management review must both be complete. Neither is optional.

Stage 2 — does it work?

The auditor samples records and interviews your people to test whether the ISMS operates as documented. Nonconformities and observations get raised here, and the certification recommendation is made.

Auditor availability

Accredited certification bodies are genuinely scarce — auditor day rates rose about 20% in 2026 on scarcity and 27001:2022 transition demand. Audit duration is also set by your headcount under ISO/IEC 27006, not negotiated. I book early; I can't invent calendar slots.

Included

  • Gap assessment against your target framework, with every finding owned and dated
  • System boundary definition and scoping
  • Complete policy set, written for how your team actually operates
  • Control implementation — hands on keyboard, not a checklist handoff
  • Compliance platform deployment, configuration and ongoing management — Vanta, Drata, or your choice. You buy the licence and own the tenant; I run it for you.
  • SSO, MFA, and conditional access rollout
  • Onboarding, offboarding, and periodic access review process
  • Evidence collection pipeline that runs continuously
  • Internal dry run against the real audit criteria
  • Auditor selection support and direct auditor engagement

Not included

  • The audit fee itself — that's paid directly to your auditor or certification body
  • Compliance platform license costs
  • Infrastructure remediation beyond 40 hours (scoped separately if needed)
  • Penetration testing (I'll refer you to someone good)
  • Anything outside the agreed system boundary
  • Certification body scheduling and the mandatory Stage 1 to Stage 2 interval

Scope creep is what turns fixed-price work into hourly work. Everything above is written into the agreement before we start so neither of us is guessing.

The guarantee, in full

What counts as audit-ready. At the end of Phase 1 we sign a Readiness Criteria document: every control in scope, what implemented looks like for each one, and what evidence satisfies it. Audit-ready means every line on that sheet is done and evidenced. It is a checklist, not an adjective, and you hold a copy.

What happens if the date slips. I keep working at no charge for up to 30 additional days on SOC 2, or 45 on ISO 27001. If we are still short after that, we re-scope together and further work is billed hourly. I would rather publish a limit I can honor than an unlimited promise neither of us believes.

What you owe me. Answers to blocking questions inside three business days, and requested administrative access inside five. The clock pauses while either is outstanding. Most fixed-price overruns are caused by waiting, not by the work.

Yes, I sit in the audit

Auditor selection, kickoff, evidence walkthroughs, and answering the auditor's questions through the end of fieldwork are in the fixed fee — up to 25 hours, with anything past that hourly. I am not going to build your environment and then leave you alone in the room with it.

One limit, stated before an auditor states it for you: management representations come from you. I can explain how a control was built and why it is implemented the way it is. I cannot attest on your behalf, because I am not your management and no honest auditor would let me.

ISO 20000-1 service management

Added alongside 27001 as an integrated management system. Few consultants run both — I've done it.

+$18,000

Year two, automated

The annual grind wired to run itself instead of billed to you every quarter. Build once, then a readiness pass before each audit cycle.

$13,000–18,500 once, then $4,000–6,000/year

Security questionnaire response

I answer the customer security reviews and vendor questionnaires that eat your engineering time.

From $1,500/month
After the certificate

Your second year should cost less than your first.

It usually costs the same, because somebody is doing by hand what a script should be doing.

What the annual grind actually is

  • Access reviews, every quarter, across every in-scope system
  • Policy review, re-approval, and re-acceptance by staff
  • Annual risk assessment refreshed, not reformatted
  • Vendor and subservice reviews with evidence attached
  • Pen test scheduled, tracked, and findings closed
  • Awareness training and an incident response tabletop
  • Evidence collected continuously, not reconstructed in week one of fieldwork

Every item on that list is calendar-driven paperwork. Firms charge $15,000 to $30,000 a year to have a person work through it. That is a reasonable price for a person and a poor price for a scheduled job.

What I do instead

I wire the recurring work once: access reviews generated and routed for sign-off, evidence collected on a schedule, policy cadence tracked, vendor reviews prompted before they lapse, drift caught when it happens rather than discovered during fieldwork.

Then I come back before each audit cycle for a readiness pass — check what drifted, fix it, confirm the evidence still holds. That is a few days a year, not a seat.

The automation lives in your tenant. If you never hire me again it keeps running, and your platform licence is yours. I would rather be re-hired because the last engagement worked than retained because leaving is painful.

✓ This sits on top of your GRC tool (Vanta, Drata, etc.), it does not replace it. Those platforms tell you a control went red. They do not fix it, and their generated policies describe a generic company rather than yours. The licence is yours and the tenant is yours — I use these tools on my own engagements, and the layer that keeps them green is the part that is missing.
! This is separate from the Readiness Sprint, and here is the honest line between them. The sprint wires up evidence collection so you can pass the first audit — that part is in the Track A, B and C price. The automation build is broader and comes after: access reviews routed for sign-off, policy and vendor cadence, drift alerting, the whole annual cycle running without a person. You are paying for year two to be cheap, not for the certificate. If you buy both, I credit the overlap rather than billing the evidence pipeline twice.

Automation build

One-time. Access reviews, evidence collection, policy and vendor cadence, drift alerting — wired to your actual stack and handed over with runbooks.

$13,000–18,500

Annual readiness pass

Before each audit cycle: what drifted, what broke, what the auditor will ask about this year. Fixed, evidenced, done.

$4,000–6,000 / year

Audit support

Sitting in fieldwork with you on renewal years, on the same terms as a first audit.

Included, up to 25 hrs
04 — EMBEDDED SECURITY ENGINEERING

Your security engineering function — with an exit date

Most consultants want to become permanent. I want to become unnecessary. I embed as your security engineering function and build the thing you'd otherwise need to hire for: identity, logging, cloud hardening, vulnerability management, automation, and the evidence pipeline underneath it all.

Then I leave. The exit criteria are written into the agreement on day one, not negotiated awkwardly eighteen months later.

Fixed term From $6,500/month 6–12 months · exit criteria defined in the SOW
Data center operations displays
How it ends

Three exits. We pick one at the start.

EXIT 01

Automated away

The work runs itself. Agent lifecycle, patching, access reviews, evidence collection, drift remediation — all automated to the point where there's no recurring human task left to bill for. This is the one I aim for.

+$13,000–18,500
Building something that runs without a person is a project, not a byproduct.

EXIT 02

Handed to your hire

You're ready for a full-time security engineer. I help write the requisition, screen candidates technically, and run the transfer — environment walkthrough, runbooks, and a documented handover so they're productive in week one instead of month three.

+$4,500
Requisition, technical screening, structured transfer, 30 days on call for their questions.

EXIT 03

Handed to your team

Your existing engineers own it. Runbooks, architecture documentation, training sessions, and the automation written so it's maintainable by people who didn't build it. No black boxes, no key-person dependency on me.

Included
Documentation is a byproduct of doing the work properly, so I don't charge for it.

✓ Yes, the exit I recommend is the one that costs extra — so here is the arithmetic. At $6,500 a month, automation that ends the engagement four months early saves you $26,000. The build costs less than that, and you keep it afterwards. If the numbers don't work that way for your environment I'll tell you, and we'll pick a different exit.
✓ Every engagement ships a handover package — runbooks, architecture docs, automation source, and credentials transfer — whether you extend or not. You're buying a capability, not a dependency.

What gets built

  • Identity architecture — SSO, MFA, conditional access, least-privilege IAM
  • Centralized logging, alerting, and tuned detection
  • Infrastructure as code, hardened baselines, drift elimination
  • Vulnerability management with remediation tracked to closure
  • CI/CD security gates and repository hardening
  • Backup, disaster recovery, and tested restore procedures
  • Access reviews and joiner/mover/leaver automation

What comes with it

  • Named security contact for customer, auditor, and insurer conversations
  • Security roadmap tied to your business milestones, not a generic maturity model
  • Risk register with real owners and milestone dates
  • Vendor and third-party security reviews
  • Incident response plan and a tabletop your team actually runs
  • Leadership reporting in plain language
05 — CLOUD ENGINEERING & ARCHITECTURE

Secure by construction, not by remediation

Everything gets built as code. Terraform for AWS. Bicep or Terraform for Azure — and for most Azure work I prefer Bicep specifically because there's no state file to manage, corrupt, lock, or lose. Azure Resource Manager already knows what's deployed; adding a second source of truth adds a failure mode without adding value.

The default posture is locked down and opened deliberately, rather than open and hardened after an incident. What that means concretely is below.

Project From $12,000 Scoped and fixed-priced after a discovery call
Illustration of server infrastructure protected by security shields
What “secured” actually means

The specifics, not the adjective.

Identity & secrets

Managed identities wherever the platform supports them — no credentials in code, no service account passwords in a config file. Everything else in Key Vault or Secrets Manager with RBAC scoped to the individual secret the workload needs, not blanket vault access. Human access scoped to resource groups, databases, and roles rather than subscription-wide grants.

Network & edge

Egress and ingress controlled deliberately. Private endpoints where public exposure isn't required. WAF and Front Door or CloudFront in front of anything internet-facing. Site-to-site and point-to-site VPN for administrative access. Segmentation that reflects trust boundaries rather than whatever the default VNet looked like.

Transport & application

HTTPS enforced with redirect, TLS 1.3 where the service supports it and 1.2 as the floor everywhere else. Authentication in front of static web apps rather than security through an obscure URL. Certificate lifecycle automated so nothing expires quietly on a weekend.

Operations

Hardened baseline images, drift detection with automated remediation, backup and disaster recovery with restores actually tested. Endpoint access governed and logged. Everything reproducible from source, so rebuilding is a pipeline run rather than an archaeology project.

Scope determines how far down this list an engagement goes — a greenfield build gets all of it, a remediation project gets what matters most first. Either way you get the reasoning, not just the change.

Typical engagements

  • Greenfield landing zone — subscription and account structure, identity, network, and guardrails before the first workload lands
  • Drift remediation — taking an environment built by hand over three years and getting it back under code
  • Multi-environment separation — development, production, and per-customer boundaries with real isolation
  • Migration — moving workloads without dropping security coverage during the cutover
  • Backup, disaster recovery, and business continuity with tested restore procedures

Tooling

  • Terraform — AWS, and Azure where cross-cloud consistency matters more than statelessness
  • Bicep — preferred for Azure-native work, no state file to manage
  • Ansible for configuration management and fleet-wide enforcement
  • Python, PowerShell, and Bash for the parts no framework covers
  • CI/CD integration so infrastructure changes go through review like application code

Also available.

Real work, scoped like everything else here — just described briefly, because most people arrive for the four above.

Logging as a Service

I take ownership of the pipeline: centralized collection across your existing platforms, alert tuning so your team isn't drowning in false positives, and first-pass triage before anything reaches you. Then the same arc as everything else — tuned until it runs without me, handed back with the runbooks. Enablement-only is the cheaper path if you'd rather own operations from the start. Either way you keep your data and your storage account.

Managed from $2,500/month · enablement scoped separately

Automation

If it happens twice, it shouldn't happen manually. SOAR playbooks, recurring reports, intake parsing, approval chains, agent lifecycle, evidence collection — and the load-bearing spreadsheet every company runs on and nobody wants to touch. Python, PowerShell, Ansible, Terraform, Power Automate, VBA, Apps Script, CI/CD. I'll use the boring tool when the boring tool is right; a macro your finance lead can read beats a microservice nobody can maintain.

Projects from $8,000 · $195/hour for smaller pieces
✓ Before you buy logging, budget the retention. Auditors generally expect twelve months of retained data already behind you — not twelve months starting when they ask. Switch logging on the month before an audit and you have failed that control with no way to catch up. It's the most common expensive surprise in a first audit, CUI environments carry stricter handling on top, and I'll size it with you in week one rather than let you find it during fieldwork.
Not sure where to start?

Tell me what's going on. I'll tell you what to fix first.

Book a 30-Minute Call Request an Assessment