Services
I offer three services. Most engagements start with the first and draw on the other two as needed. Each one ends with something your team keeps: working automation, an evidence set, or a written decision record.
01
Vulnerability Management Program & Automation
The problem: the scanner runs, the findings pile up, and nobody can say whether risk is going down. Queues are sorted by CVSS, tickets go to the wrong owners, and hosts that weren't scanned look the same as hosts that are clean.
Who it's for: enterprise VM teams with a program that has stalled or outgrown its manual steps, and IT leads at mid-size organizations who need a program for the first time. A scan-based vulnerability assessment is a common way in: it shows where you stand before you commit to more.
Scope this02
Compliance Evidence
The problem: an assessor grades your evidence, not your scanner. Scan exports and ticket histories rarely show scope, authentication and verified fixes in a form someone else can follow.
Who it's for: defense industrial base subcontractors working toward NIST 800-171 and CMMC Level 2, and organizations with HIPAA or PCI obligations. I prepare evidence; I don't certify anyone.
Scope this03
Security Architecture & Advisory
The problem: vulnerability data keeps pointing at the same design issues (flat networks, shared admin accounts, logs nobody can search), and a scanner can't fix those.
Who it's for: IT and security leads who want an independent review before a change, or a standing second opinion on a retainer.
Scope this
Working with MSPs and vCISOs
If you run an MSP or a vCISO practice, I can work as your subcontractor on vulnerability management and compliance evidence work. If I work with your client through you, they stay your client: I don't market to them or take on work from them directly. I deliver to your scope and your schedule, and I write for your client as well as for you. Tell me what the client needs and the timeline, and we can agree terms before anything reaches the client.