Fractional Cybersecurity Program Lead
Practical cybersecurity programs for small companies facing SOC 2, customer security questionnaires, and similar demands. Policies, controls, and audit readiness without the cost of a full-time CISO.
Start a ConversationI build and run cybersecurity programs for small companies. From establishing the foundational policies and controls to leading organizations through SOC 2 audit preparation. I've built a security program from the ground up for a company with no prior formal program, and led that same organization through four consecutive SOC 2 audits with zero findings, three of them Type 2.
This work spans policies, technical controls, vendor oversight, customer questionnaire responses, cyber insurance readiness, and ongoing governance. If your team is adopting AI tools, that governance extends naturally from this same program, covered as a dedicated AI Governance engagement.
When Customers Start Asking Questions You Can't Answer
It usually starts with a deal. An enterprise prospect is ready to move forward, and then their security team sends over a questionnaire. Forty pages of detailed questions about your data handling, access controls, encryption, incident response, and audit history. Nobody on your team knows how to respond. The answers get cobbled together by a developer and a project manager who do their best, but the responses reveal gaps that are impossible to hide. The deal stalls. Sometimes it dies.
That's the moment most small companies realize they need a security program. Not because of a breach, but because the lack of one is costing them revenue. Enterprise customers have security requirements, and those requirements get stricter every year. If you can't produce a SOC 2 report, if you can't describe your controls in language that satisfies a procurement review, you're excluded from the deals that drive real growth. The question isn't whether you need a security program. It's how long you can afford to operate without one.
The challenge is that many companies already have reasonable security practices in place. They're just not documented, not formalized, and not auditable. Developers are following good habits. Infrastructure is configured sensibly. But none of it is written down in a way an auditor or enterprise customer can verify. There's no policy library. No evidence collection process. No formal vendor oversight or incident response plan. The practices exist, the program doesn't. SOC 2 audit preparation requires a program, not just good intentions.
The other pattern I see is companies that treat security as a technical problem. Firewalls, passwords, vulnerability scans. They miss that a security program is an organizational discipline. It's about governance, accountability, and continuous improvement. It's about knowing what your risks are, documenting how you manage them, and proving it to the people who need proof. That's what enterprise customer security requirements actually demand, and it's what a SOC 2 auditor evaluates.
If every security questionnaire is a scramble, if you've lost a deal because you couldn't produce the right documentation, or if you know a SOC 2 audit is on the horizon and you're not sure where to start, that's the situation this engagement is designed to address. A practical, defensible security program built by someone who has done it before and knows what auditors are actually looking for.
What's Included
Security Program Build-out
Establish the policies, controls, and processes that form the foundation of a defensible security program. From nothing, or from an incomplete baseline.
SOC 2 Audit Readiness
Gap assessment, control implementation, evidence collection, and audit coordination for SOC 2 Type 1 or Type 2, including working directly with your auditors.
Security Questionnaire Response
Respond to customer and enterprise security questionnaires in language that satisfies security and procurement reviews.
Vendor Security Oversight
Assess and monitor third-party vendors against your security requirements and document the outcomes for audit purposes.
Cyber Insurance Readiness
Prepare for cyber insurance applications and renewals by documenting the controls insurers ask about and closing the gaps that drive up premiums or deny coverage.
Ongoing Security Governance
Regular review of security posture, incident response readiness, and control effectiveness. Keeping your program current between audits.
How Engagements Work
Security program engagements typically run at Tier 3 during the initial build or audit preparation phase, then taper to Tier 1 or Tier 2 for ongoing governance.
Tier 3 - Transformation (multiple days/month): Active SOC 2 preparation, program build-out from scratch, or major compliance initiatives requiring close coordination with auditors and internal teams.
Tier 2 - Core (2–3 days/month): Monthly security oversight, control monitoring, vendor assessments, and ongoing questionnaire support.
Tier 1 - Advisory (~1 day/month): Quarterly reviews, policy updates, and on-call support for security questions and questionnaire responses between audits.
If You're Not the Technical Person
This engagement is often bought by the person who runs operations, finance, a practice, or compliance, not engineering. A customer, an auditor, or an insurer asked for something, and it landed on their desk. Here's what the engagement looks like from that seat.
What it looks like. Security gets a named owner who reports to you. You get a plan with dates, a short written status you can repeat to a customer, an underwriter, or the board, and one person to hand the next questionnaire to.
What you get. A policy set written for your company, an inventory of the controls you already have and the ones you need, the evidence to back them up, answers to customer questionnaires and insurance applications, and coordination with the auditor if a SOC 2 report is the goal.
What you don't have to do. Write policies, learn the frameworks, manage the auditor, or chase your team for evidence. Your part is the decisions: which risks the company will accept, what it will commit to, and what to tell customers.
Who This Is For
This engagement fits companies in one of these situations:
SaaS companies facing their first SOC 2 audit, or struggling to get a clean Type 2 opinion, because enterprise customers won't buy without the report
Healthcare vendors and business associates facing HIPAA security obligations and customer due diligence they can't answer with confidence
Financial services firms and their vendors facing client and regulator security questionnaires that stall deals or renewals
Any company whose cyber insurance application or renewal now requires attestations to controls like MFA, endpoint protection, and a documented incident response plan
Companies with reasonable security practices already in place that have never been formalized, documented, or made auditable
Experience & Proof Points
Built an information security program from the ground up for a company with no prior formal program. Four consecutive SOC 2 audits, zero findings. Three of them Type 2.
Responded to enterprise client security questionnaires, translating technical controls into language that satisfies procurement and security reviews.
25+ years in technology leadership, including a decade designing HIPAA-compliant application architecture for a healthcare organization and platform work in financial services. Understands what those industries expect from a vendor's security posture.
More on the thinking behind this work in Building an Information Security Program from Scratch When You Have Nothing.
Ready to talk?
Tell me where you are with your security program and I'll let you know what an engagement could look like.
Start a ConversationCommon Questions
- How do you get SOC 2 audit ready without a security team? You get SOC 2 ready without a security team by documenting the controls you already run and closing the gaps in priority order. What audit readiness involves.
- SOC 2 Type 1 vs Type 2: which do you need first? If a customer is waiting on a report, start with SOC 2 Type 1. Why, how long it takes, and when to go straight to Type 2.
- How do you answer enterprise security questionnaires? Answer enterprise security questionnaires from a maintained set of control documentation, not from scratch each time. What buyers ask for and how to be ready.
- What security controls does cyber insurance require? Cyber insurers ask about the same controls a security program is built on: MFA, endpoint protection, backups, access reviews, and an incident response plan.