Security Engineering Services

Enterprise-quality security adapted for growing companies. Clear scope, transparent pricing, measurable results.

I offer specialized security services designed for startups and mid-market companies that need more than basic security but aren't ready to hire a full security team. All services include documentation, knowledge transfer, and a support period after delivery.

I offer services at multiple price points because I remember what it was like starting out. Sometimes you just need an hour of expert advice ($500 advisory session). Sometimes you need a quick security check before a big demo ($2,500 rapid review). And sometimes you need comprehensive security engineering ($15K+ full projects). Start where it makes sense for your stage and budget. Many clients begin with advisory sessions, then move to larger projects once we've built trust and they see the value.

💡

Not Sure If You Need a Full Engagement?

Start with a $500 advisory session or $2,500 rapid review. Get expert guidance without committing to a full project.

Many clients start small to build trust, then move to larger engagements when they see the value.

Quick Consultations & Advisory Sessions

Not every security challenge needs a full engagement. Sometimes you just need expert advice, a second opinion, or guidance on a specific decision.

💡

Security Advisory Session

WHO THIS IS FOR:

Technical leaders who need expert guidance on a specific security decision, architecture review, or want a second opinion before committing to a larger initiative.

Single-Focus Sessions (choose one):

  • Architecture review for a specific feature or system
  • Threat modeling workshop for new product
  • Security tool evaluation and selection advice
  • Compliance readiness assessment (high-level)
  • Career mentorship for security engineers
  • "Am I secure enough?" reality check
  • Vendor security assessment review
  • Incident response planning discussion

Each session includes:

  • 60-90 minute video call
  • Written summary of recommendations
  • Action items with priorities
  • Resource links and references
  • 1 week of follow-up email support
TIMELINE: 1 session
INVESTMENT: $500 per session

Perfect for: Quick decisions, second opinions, spot guidance

🎓

Security Engineering Mentorship

WHO THIS IS FOR:

Junior to mid-level security engineers wanting to level up their skills, developers transitioning into security roles, or technical leaders building security expertise in their teams.

WHAT YOU GET:

Topics we can cover:

  • Application security and secure code review
  • Cloud security architecture (AWS focus)
  • IAM and access control patterns
  • Security automation and tooling
  • Incident response and forensics
  • Career progression in security engineering

Each session includes:

  • Two 60-minute mentorship sessions per month
  • Code review and feedback on your security projects
  • Career guidance and skill development roadmap
  • Access to my security resources and templates
  • Async Slack/email support between sessions
  • Real-world problem-solving practice
  • Resume and interview preparation (if needed)
TIMELINE: Ongoing
INVESTMENT: $800/month

(3-month minimum commitment) | Individual sessions: $500/hour (if not doing monthly package)

🔍

Rapid Security Review (1 Week)

WHO THIS IS FOR:

Startups that need quick security feedback before a demo day, product launch, or customer security questionnaire. Not a full audit, but faster and more affordable than comprehensive assessments.

WHAT YOU GET:

Each session includes:

  • High-level architecture review
  • Automated vulnerability scanning
  • Common misconfiguration check
  • Critical risk identification only (no deep dive)
  • 1-hour findings presentation
  • Short written report (5-10 pages max)
  • Quick-win recommendations list

What this is NOT:

  • Not a compliance audit
  • Not penetration testing
  • Not comprehensive threat modeling
  • Not suitable for regulated industries (HIPAA, finance)

Perfect for: Early-stage startups, pre-seed to Series A

TIMELINE: 1 week (5 business days)
INVESTMENT: $2,500

Includes: Assessment, report, and 1-hour presentation

🔒

Security Audit & Compliance Preparation

WHO THIS IS FOR:

Startups preparing for investor due diligence, companies pursuing SOC 2 or ISO 27001 certification, or any business that needs to understand their current security posture.

WHAT'S INCLUDED:

  • Comprehensive security assessment across infrastructure, applications, and processes
  • Vulnerability identification and risk prioritization
  • Compliance gap analysis (SOC 2, GDPR, HIPAA considerations)
  • Threat modeling for your specific architecture
  • Executive summary for non-technical stakeholders
  • Detailed technical remediation roadmap
  • Security policy templates and documentation
  • 2 weeks of implementation support

DELIVERABLES:

  • Executive security report (for board, investors, customers)
  • Technical findings document with proof-of-concepts
  • Prioritized remediation roadmap (quick wins → long-term improvements)
  • Security policies and procedures templates
  • Compliance checklist specific to your industry

TYPICAL RESULTS:

  • Identified 15-30 security issues before auditors/investors found them
  • Reduced audit preparation time by 40%
  • Achieved compliance certification on first attempt
  • Gave technical teams clear direction on what to fix first
TIMELINE: 2-4 weeks
INVESTMENT: $12,000 - $25,000

(Varies based on infrastructure size and compliance requirements) | Includes: Comprehensive assessment, all documentation, and 2 weeks post-delivery support

🔐

Identity & Access Management (IAM) Architecture

WHO THIS IS FOR:

SaaS companies scaling from 10 → 100+ users with complex permission requirements, businesses building multi-tenant systems, or teams struggling with unmaintainable authorization code.

WHAT'S INCLUDED:

  • Current system assessment and pain point analysis
  • Authorization model design (RBAC, ABAC, or FGAC based on needs)
  • Zero-trust architecture planning
  • Policy-as-code implementation
  • OAuth 2.0 / SAML integration strategy
  • Database schema design for permissions
  • Developer documentation and best practices
  • 30 days post-implementation support

DELIVERABLES:

  • IAM architecture document with diagrams
  • Authorization model specification
  • Reference implementation code
  • Database migration scripts (if applicable)
  • Developer guidelines and examples
  • Testing strategy and test cases

TYPICAL RESULTS:

At Amazon, I partnered with 50+ development teams implementing ABAC and FGAC models:

  • Reduced unauthorized access incidents by 35%
  • Enabled teams to scale from dozens to thousands of users
  • Simplified permission management for complex enterprise requirements
TIMELINE: 3-5 weeks
INVESTMENT: $15,000 - $30,000

(Depends on system complexity and integration requirements) | Includes: Full architecture, reference code, implementation support, and 30 days post-launch support

⚙️

Security Automation & Continuous Monitoring

WHO THIS IS FOR:

Teams spending too much time on manual security reviews, companies wanting to shift left on security, or engineering organizations that need security integrated into CI/CD.

WHAT'S INCLUDED:

  • Current security workflow assessment
  • Automated vulnerability scanning pipeline
  • CI/CD security integration (SAST, DAST, dependency scanning)
  • Custom security tooling development (Python/AWS)
  • Security metrics dashboard
  • Alert and notification automation
  • Runbook documentation
  • Team training on new tools
  • 60 days of monitoring and refinement

DELIVERABLES:

  • Automated security scanning infrastructure
  • CI/CD pipeline security gates
  • Security metrics dashboard
  • Custom tooling (scripts, Lambda functions, automation)
  • Documentation and training materials
  • Alert configuration and response playbooks

TYPICAL RESULTS:

From my work at Amazon automating security processes:

  • Reduced manual security assessments by 70%
  • Cut security review time from days to hours
  • Decreased false positives by 30% through intelligent filtering
  • Enabled security to scale without adding headcount
TIMELINE: 4-6 weeks
INVESTMENT: $18,000 - $35,000

(Based on scope of automation and infrastructure complexity) | Includes: All tooling, implementation, training, and 60-day refinement period

🚨

Incident Response & Investigation

WHO THIS IS FOR:

Companies that experienced or suspect a security breach, businesses needing incident response planning, or organizations wanting a security incident commander on call.

WHAT'S INCLUDED:

  • Reactive (Incident Already Occurred):
  • Immediate incident assessment and scoping
  • Containment strategy and execution
  • Digital forensics investigation
  • Evidence collection and preservation
  • Root cause analysis
  • Remediation implementation
  • Post-mortem documentation
  • Process improvements to prevent recurrence
  • Proactive (Before Incident):
  • Incident response plan development
  • Playbook creation for common scenarios
  • Team training and tabletop exercises
  • On-call retainer arrangement

DELIVERABLES:

  • Incident timeline and attack vector analysis
  • Forensics report with evidence
  • Containment and remediation steps taken
  • Post-mortem report for stakeholders
  • Preventive measures roadmap
  • Updated security procedures

SPECIALIZED BACKGROUND:

  • Investigated 200+ security incidents with 95% closure rate
  • Reduced incident response time by 66% through automation
  • Built investigation methodology and forensics frameworks
  • Experience with insider threats, data breaches, and compromise scenarios

TRACK RECORD:

At Amazon and CIA:

  • Investigated 200+ security incidents with 95% closure rate
  • Reduced incident response time by 66% through automation
  • Built investigation methodology and forensics frameworks
  • Experience with insider threats, data breaches, and compromise scenarios
TIMELINE: Immediate response - 2 weeks (incident-dependent)
INVESTMENT: Emergency Response: $5,000 - $15,000 (incident-dependent) | Incident Response Planning: $6,000 - $10,000 | Emergency Retainer: $2,500/month (priority access, 4-hour SLA)

Available 24/7 for critical incidents

🤖

AI & Machine Learning Security

WHO THIS IS FOR:

Companies building AI-powered products, startups using LLMs in production, or businesses needing to secure machine learning pipelines and training data.

WHAT'S INCLUDED:

  • AI/ML security assessment (models, APIs, training data)
  • Threat modeling for AI-specific attack vectors
  • Prompt injection and jailbreak testing
  • Model security framework implementation
  • Data privacy and governance review
  • Compliance considerations (AI regulations)
  • Security monitoring for AI systems
  • Developer guidelines for secure AI development
  • 3 weeks of implementation support

DELIVERABLES:

  • AI security assessment report
  • Threat model specific to your AI architecture
  • Security framework adapted for AI workloads
  • Testing results (prompt injection, model extraction attempts)
  • Monitoring and alerting setup
  • AI security best practices documentation
TIMELINE: 3-5 weeks
INVESTMENT: $20,000 - $40,000

(Based on number of models, data sensitivity, and compliance requirements) | Includes: Full assessment, framework implementation, and 3 weeks support

🔄

Ongoing Security Retainer

WHO THIS IS FOR:

Growing companies needing consistent security expertise without hiring full-time, businesses wanting priority access for emerging issues, or teams that benefit from monthly security reviews.

WHAT'S INCLUDED:

  • Dedicated monthly hours (30 or 50 hour options)
  • Priority response time (4-hour SLA for urgent issues)
  • Flexible scope - mix of audits, development, consulting, incident response
  • Monthly security review and strategy call
  • Quarterly security posture reports
  • Direct Slack/email access
  • Proactive monitoring and recommendations
  • First priority for emergency issues

HOW IT WORKS:

You get a bank of hours each month to use as needed:

  • Security reviews for new features
  • Compliance preparation work
  • IAM architecture refinement
  • Incident response when needed
  • Team training and knowledge transfer
  • Strategic security planning

Hours don't roll over, but we plan monthly to ensure efficient use.

WHY RETAINER WORKS:

  • 40% cost savings vs. hourly project work
  • Consistent security oversight as you scale
  • No sticker shock when emergencies arise
  • I become familiar with your systems over time
  • Faster responses because I know your context
  • Predictable monthly expense for budgeting

RETAINER OPTIONS:

Starter Plan: $3,500/month
  • 15 hours per month
  • 8-hour SLA for urgent issues
  • Monthly check-in call
  • Perfect for early-stage startups
Standard Plan: $7,000/month
  • 30 hours per month
  • 4-hour SLA for urgent issues
  • Bi-weekly strategy calls
  • Quarterly security reporting
Premium Plan: $12,000/month
  • 50 hours per month
  • 2-hour SLA for urgent issues
  • Weekly strategy calls
  • Quarterly reporting + annual security roadmap

All retainers include direct Slack/email access and rollover of up to 5 unused hours per month.

TIMELINE:
INVESTMENT:

Which Service Is Right For You?

Your SituationRecommended ServiceInvestmentTimeline
"I need quick advice on a specific security decision"Security Advisory Session$5001 session
"I want to learn security engineering from an expert"Technical Mentorship$800/monthOngoing
"We need basic security feedback before launching"Rapid Security Review$2,5001 week
"We're preparing for investor due diligence"Security Audit & Compliance$12K-$25K2-4 weeks
"Our permissions system is becoming unmaintainable"IAM Architecture$15K-$30K3-5 weeks
"We waste too much time on manual security work"Security Automation$18K-$35K4-6 weeks
"We're building AI-powered features"AI/ML Security$20K-$40K3-5 weeks
"We suspect a security breach"Incident Response$5K-$15KImmediate
"We need ongoing security support"Security Retainer$3.5K-$12K/moMonthly

Need Something Different?

Every business has unique security challenges. If your needs don't fit a standard package above, let's discuss a custom engagement.

Additional areas I work in:

Application security reviews and penetration testing
Cloud security architecture (AWS, Azure, GCP)
Security training and team enablement
Data pipeline security and governance
Compliance program development
Third-party security assessments
Security tool evaluation and selection
Technical security advisory (fractional CISO work)

I'll work with you to define scope, deliverables, timeline, and pricing that fits your situation.

Common Questions

Q: Do you work with my tech stack?

A: I specialize in AWS, Python, JavaScript/Node.js, PostgreSQL, and most modern development stacks. I'm technology-agnostic and comfortable learning what's needed. If you're using something unusual, let's discuss—I've worked with everything from cutting-edge AI frameworks to legacy mainframe systems.

Q: Can you start immediately?

A: It depends on current project commitments. Typical lead time is 1-2 weeks for new engagements. Emergency incident response can often be prioritized within 24 hours. Retainer clients get immediate priority access.

Q: What if the scope changes mid-project?

A: We'll establish clear milestones and check-ins. If scope changes, we handle it through a transparent change order process—you'll always know what you're paying for and why. No surprise bills.

Q: Do you offer payment plans?

A: Yes. Standard terms for project work are 50% upfront, 50% on delivery. For larger engagements over $20K, we can structure milestone-based payments. Retainers are invoiced monthly in advance.

Q: Do you sign NDAs and work under contract?

A: Absolutely. Your security concerns and business details stay confidential. I'll sign your NDA or we can use mine. All work is done under a clear contract with defined scope, deliverables, and terms.

Q: Do you work onsite or remote?

A: Primarily remote, which keeps costs down for you. I'm based in Arlington, VA and can meet onsite for initial kickoffs or critical sessions if you're in the DC/Northern Virginia area.

Q: What if we're not a good fit?

A: I'll tell you honestly in our first conversation. If I'm not the right person for your needs, I'll likely know someone who is and can make a referral.

Q: Do you have experience with [specific compliance standard]?

A: I've worked extensively with SOC 2, HIPAA, and GDPR requirements, particularly at Amazon where compliance was critical. If you need specialized expertise in CMMC, PCI-DSS, or other frameworks, I can advise or bring in a specialist partner.

Q: What happens after the project ends?

A: Every engagement includes a support period (typically 2-4 weeks) for questions and minor adjustments. After that, you own all deliverables and documentation. Many clients convert to retainers for ongoing support.

Q: How do you communicate progress?

A: Weekly status updates minimum, plus async updates via Slack/email as needed. For longer engagements, bi-weekly check-in calls. You'll always know what's been done, what's next, and if there are any blockers.

Ready to Get Started?

Schedule a free 20-minute consultation to discuss your security needs. No obligation, no sales pressure—just an honest conversation about your challenges and how I can help.