Cybersecurity

From assessment to offensive testing to governance, hands-on or advisory.

I work with cybersecurity in one of two ways — executing services directly myself (assessments, offensive testing, governance reviews) or advising and overseeing your team or vendor while they carry out the work. Outside this scope — digital forensics, deep/dark web monitoring, and a proprietary 24/7 SOC.

What this can include

Assessment & governance

Cybersecurity and security posture assessments, gap analysis, and maturity evaluation
Security architecture review and risk/threat modeling
Security roadmap and remediation planning

Offensive testing

Vulnerability management: scanning, assessment, prioritization, and re-testing
Penetration testing (web, API, mobile, network, cloud, Active Directory, IoT)
Red team, purple team, and authorized adversary simulation

Application, cloud & identity security

Secure code review, SAST/DAST, and OWASP-aligned reviews
Hardening (Linux, Windows, servers, databases, Active Directory, cloud, CIS Benchmarks)
Cloud and identity security (AWS/Azure/GCP, IAM, MFA, Zero Trust)

Specialized advisory

Bug bounty design, threat intelligence, and threat hunting
SIEM strategy and SOC/MDR coordination through partners
OT/ICS/SCADA security, DLP, email security, and ransomware readiness
Virtual CISO (vCISO) engagements

Let's talk

Scope, duration, modality, and deliverables are defined per engagement: an assessment, a project, recurring advisory, a block of hours, an audit, selective hands-on execution, or bringing me on full-time as in-house staff. No fixed pricing is published here; let's talk about what fits.

Ask about this service