How I work
Every engagement follows the same shape: agree the scope in writing, do the work in your environment with regular check-ins, and hand over everything your team needs to keep going.
1. Scoping
A 30-minute call about your environment, your scanner, what's driving the work and your timeline. Afterwards I send a written scope: objectives, what's in and out, deliverables, duration and how we'll measure done. You get a scope, not a sales sequence. If the work isn't a good fit for me, I'll say so on the call.
2. Paperwork and kickoff
Before any access is granted we sign an NDA (mine or yours) and agree rules of engagement: which systems, which accounts, which hours, who to call if something looks wrong, and how sensitive data moves. Kickoff confirms owners and the check-in cadence.
3. Delivery
I do the work myself rather than handing it to a junior team. If an engagement needs more hands, such as analysts for an ongoing program, who they are and what they do is in the written scope. You get a short status note at each check-in, weekly by default: what's done, what's blocked, what's next. Findings that need action come to you as I find them, not in a final report. If something urgent turns up, such as an exposed system or a scan that has been failing for months, you hear about it right away, not at the next check-in.
4. Handoff
The automation, evidence and documentation live in your systems from day one. Handoff is a walk-through with the people who'll run it, plus a runbook. Your team owns the credentials, licenses, automation and remediation. Unless you choose to keep me on, nothing depends on me after the engagement ends.
What I need from you
- One named point of contact who can make decisions.
- Read access to scanner consoles and exports, and to the ticketing system and CMDB where relevant.
- An agreed way to share sensitive files. Never ordinary email.
- Time with the people who own the systems.
Questions
Fixed scope or retainer? Most work is fixed scope. A retainer suits ongoing advisory or a program that needs regular tuning after the build.
How long do engagements take? It depends on the size of your environment and the scope. You get a timeline with the written scope.
Do you work remotely? Yes. I can come on site for short visits when the work needs it, but not on a regular basis.
Do you work through MSPs or vCISOs? Yes, as a subcontractor. See Services.
Do you publish prices? No. Every scope is different; you get a quote with the written scope.
What if the scope changes? We agree the change in writing before the work starts, with its effect on timeline and cost.
Will you need admin access? Usually read-only access is enough. Where a change needs elevated access, your team makes it or we agree it in the rules of engagement first.