Security Engineering Services

Enterprise-quality security adapted for growing companies. Clear scope, transparent pricing, measurable results.

I offer specialized security services designed for startups and mid-market companies that need more than basic security but aren't ready to hire a full security team. All services include documentation, knowledge transfer, and a support period after delivery.

I offer services at multiple price points because I remember what it was like starting out. Sometimes you just need an hour of expert advice ($500 advisory session). Sometimes you need a quick security check before a big demo ($2,500 rapid review). And sometimes you need comprehensive security engineering ($15K+ full projects). Start where it makes sense for your stage and budget. Many clients begin with advisory sessions, then move to larger projects once we've built trust and they see the value.

* All prices shown are estimates and can be customized based on the specific scope and amount of work requested. Final pricing will be provided after discussing your unique requirements.

💡

Not Sure If You Need a Full Engagement?

Start with a $500 advisory session or $2,500 rapid review. Get expert guidance without committing to a full project.

Many clients start small to build trust, then move to larger engagements when they see the value.

Quick Consultations & Advisory Sessions

Not every security challenge needs a full engagement. Sometimes you just need expert advice, a second opinion, or guidance on a specific decision.

💡

Security Advisory Session

WHO THIS IS FOR:

Technical leaders who need expert guidance on a specific security decision, architecture review, or want a second opinion before committing to a larger initiative.

Single-Focus Sessions (choose one):

  • Architecture review for a specific feature or system
  • Threat modeling workshop for new product
  • Security tool evaluation and selection advice
  • Compliance readiness assessment (high-level)
  • Career mentorship for security engineers
  • "Am I secure enough?" reality check
  • Vendor security assessment review
  • Incident response planning discussion

Each session includes:

  • 60-90 minute video call
  • Written summary of recommendations
  • Action items with priorities
  • Resource links and references
  • 1 week of follow-up email support
TIMELINE: 1 session
INVESTMENT: $500 per session

Perfect for: Quick decisions, second opinions, spot guidance

* Price is an estimate and can be customized based on scope

🎓

Security Engineering Mentorship

WHO THIS IS FOR:

Junior to mid-level security engineers wanting to level up their skills, developers transitioning into security roles, or technical leaders building security expertise in their teams.

WHAT YOU GET:

Topics we can cover:

  • Application security and secure code review
  • Cloud security architecture (AWS focus)
  • IAM and access control patterns
  • Security automation and tooling
  • Incident response and forensics
  • Career progression in security engineering

Each session includes:

  • Two 60-minute mentorship sessions per month
  • Code review and feedback on your security projects
  • Career guidance and skill development roadmap
  • Access to my security resources and templates
  • Async Slack/email support between sessions
  • Real-world problem-solving practice
  • Resume and interview preparation (if needed)
TIMELINE: Ongoing
INVESTMENT: $150 - $300/month

(Subscription) OR $95 - $150/hour (individual sessions) | Tiers: Starter ($150/mo, 2hrs), Professional ($225/mo, 4hrs), Executive ($300/mo, 6hrs)

* Price is an estimate and can be customized based on scope

🔍

Rapid Security Review (1 Week)

WHO THIS IS FOR:

Startups that need quick security feedback before a demo day, product launch, or customer security questionnaire. Not a full audit, but faster and more affordable than comprehensive assessments.

WHAT YOU GET:

Each session includes:

  • High-level architecture review
  • Automated vulnerability scanning
  • Common misconfiguration check
  • Critical risk identification only (no deep dive)
  • 1-hour findings presentation
  • Short written report (5-10 pages max)
  • Quick-win recommendations list

What this is NOT:

  • Not a compliance audit
  • Not penetration testing
  • Not comprehensive threat modeling
  • Not suitable for regulated industries (HIPAA, finance)

Perfect for: Early-stage startups, pre-seed to Series A

TIMELINE: 1 week (5 business days)
INVESTMENT: $2,500

Includes: Assessment, report, and 1-hour presentation

* Price is an estimate and can be customized based on scope

🔒

Security Audit & Compliance Preparation

WHO THIS IS FOR:

Startups preparing for investor due diligence, companies pursuing SOC 2 or ISO 27001 certification, or any business that needs to understand their current security posture.

WHAT'S INCLUDED:

  • Comprehensive security assessment across infrastructure, applications, and processes
  • Vulnerability identification and risk prioritization
  • Compliance gap analysis (SOC 2, GDPR, HIPAA considerations)
  • Threat modeling for your specific architecture
  • Executive summary for non-technical stakeholders
  • Detailed technical remediation roadmap
  • Security policy templates and documentation
  • 2 weeks of implementation support

DELIVERABLES:

  • Executive security report (for board, investors, customers)
  • Technical findings document with proof-of-concepts
  • Prioritized remediation roadmap (quick wins → long-term improvements)
  • Security policies and procedures templates
  • Compliance checklist specific to your industry

TYPICAL RESULTS:

  • Identified 15-30 security issues before auditors/investors found them
  • Reduced audit preparation time by 40%
  • Achieved compliance certification on first attempt
  • Gave technical teams clear direction on what to fix first
TIMELINE: 2-4 weeks
INVESTMENT: $12,000 - $35,000

(Varies based on infrastructure size and compliance requirements) | Includes: Comprehensive assessment, all documentation, and 2 weeks post-delivery support

* Price is an estimate and can be customized based on scope

🔐

Identity & Access Management (IAM) Architecture

WHO THIS IS FOR:

SaaS companies scaling from 10 → 100+ users with complex permission requirements, businesses building multi-tenant systems, or teams struggling with unmaintainable authorization code.

WHAT'S INCLUDED:

  • Current system assessment and pain point analysis
  • Authorization model design (RBAC, ABAC, or FGAC based on needs)
  • Zero-trust architecture planning
  • Policy-as-code implementation
  • OAuth 2.0 / SAML integration strategy
  • Database schema design for permissions
  • Developer documentation and best practices
  • 30 days post-implementation support

DELIVERABLES:

  • IAM architecture document with diagrams
  • Authorization model specification
  • Reference implementation code
  • Database migration scripts (if applicable)
  • Developer guidelines and examples
  • Testing strategy and test cases

TYPICAL RESULTS:

At Amazon, I partnered with 50+ development teams implementing ABAC and FGAC models:

  • Reduced unauthorized access incidents by 35%
  • Enabled teams to scale from dozens to thousands of users
  • Simplified permission management for complex enterprise requirements
TIMELINE: 3-5 weeks
INVESTMENT: $14,000 - $45,000

(Depends on system complexity and integration requirements) | Includes: Full architecture, reference code, implementation support, and 30 days post-launch support

* Price is an estimate and can be customized based on scope

⚙️

Security Automation & Continuous Monitoring

WHO THIS IS FOR:

Teams spending too much time on manual security reviews, companies wanting to shift left on security, or engineering organizations that need security integrated into CI/CD.

WHAT'S INCLUDED:

  • Current security workflow assessment
  • Automated vulnerability scanning pipeline
  • CI/CD security integration (SAST, DAST, dependency scanning)
  • Custom security tooling development (Python/AWS)
  • Security metrics dashboard
  • Alert and notification automation
  • Runbook documentation
  • Team training on new tools
  • 60 days of monitoring and refinement

DELIVERABLES:

  • Automated security scanning infrastructure
  • CI/CD pipeline security gates
  • Security metrics dashboard
  • Custom tooling (scripts, Lambda functions, automation)
  • Documentation and training materials
  • Alert configuration and response playbooks

TYPICAL RESULTS:

From my work at Amazon automating security processes:

  • Reduced manual security assessments by 70%
  • Cut security review time from days to hours
  • Decreased false positives by 30% through intelligent filtering
  • Enabled security to scale without adding headcount
TIMELINE: 4-6 weeks
INVESTMENT: $15,000 - $55,000

(Based on scope of automation and infrastructure complexity) | Includes: All tooling, implementation, training, and 60-day refinement period

* Price is an estimate and can be customized based on scope

🚨

Incident Response & Investigation

WHO THIS IS FOR:

Companies that experienced or suspect a security breach, businesses needing incident response planning, or organizations wanting a security incident commander on call.

WHAT'S INCLUDED:

  • Reactive (Incident Already Occurred):
  • Immediate incident assessment and scoping
  • Containment strategy and execution
  • Digital forensics investigation
  • Evidence collection and preservation
  • Root cause analysis
  • Remediation implementation
  • Post-mortem documentation
  • Process improvements to prevent recurrence
  • Proactive (Before Incident):
  • Incident response plan development
  • Playbook creation for common scenarios
  • Team training and tabletop exercises
  • On-call retainer arrangement

DELIVERABLES:

  • Incident timeline and attack vector analysis
  • Forensics report with evidence
  • Containment and remediation steps taken
  • Post-mortem report for stakeholders
  • Preventive measures roadmap
  • Updated security procedures

SPECIALIZED BACKGROUND:

  • Investigated 200+ security incidents with 95% closure rate
  • Reduced incident response time by 66% through automation
  • Built investigation methodology and forensics frameworks
  • Experience with insider threats, data breaches, and compromise scenarios

TRACK RECORD:

At Amazon and CIA:

  • Investigated 200+ security incidents with 95% closure rate
  • Reduced incident response time by 66% through automation
  • Built investigation methodology and forensics frameworks
  • Experience with insider threats, data breaches, and compromise scenarios
TIMELINE: Immediate response - 2 weeks (incident-dependent)
INVESTMENT: Emergency Response: $6,000 - $18,000 (incident-dependent) | Incident Response Planning: $4,500 - $8,000 | Emergency Retainer: $1,500/month (priority access, 4-hour SLA)

Available 24/7 for critical incidents

* Price is an estimate and can be customized based on scope

🤖

AI & Machine Learning Security

WHO THIS IS FOR:

Companies building AI-powered products, startups using LLMs in production, or businesses needing to secure machine learning pipelines and training data.

WHAT'S INCLUDED:

  • AI/ML security assessment (models, APIs, training data)
  • Threat modeling for AI-specific attack vectors
  • Prompt injection and jailbreak testing
  • Model security framework implementation
  • Data privacy and governance review
  • Compliance considerations (AI regulations)
  • Security monitoring for AI systems
  • Developer guidelines for secure AI development
  • 3 weeks of implementation support

DELIVERABLES:

  • AI security assessment report
  • Threat model specific to your AI architecture
  • Security framework adapted for AI workloads
  • Testing results (prompt injection, model extraction attempts)
  • Monitoring and alerting setup
  • AI security best practices documentation
TIMELINE: 3-5 weeks
INVESTMENT: $18,000 - $60,000

(Based on number of models, data sensitivity, and compliance requirements) | Includes: Full assessment, framework implementation, and 3 weeks support

* Price is an estimate and can be customized based on scope

🔄

Ongoing Security Retainer

WHO THIS IS FOR:

Growing companies needing consistent security expertise without hiring full-time, businesses wanting priority access for emerging issues, or teams that benefit from monthly security reviews.

WHAT'S INCLUDED:

  • Dedicated monthly hours (30 or 50 hour options)
  • Priority response time (4-hour SLA for urgent issues)
  • Flexible scope - mix of audits, development, consulting, incident response
  • Monthly security review and strategy call
  • Quarterly security posture reports
  • Direct Slack/email access
  • Proactive monitoring and recommendations
  • First priority for emergency issues

HOW IT WORKS:

You get a bank of hours each month to use as needed:

  • Security reviews for new features
  • Compliance preparation work
  • IAM architecture refinement
  • Incident response when needed
  • Team training and knowledge transfer
  • Strategic security planning

Hours don't roll over, but we plan monthly to ensure efficient use.

WHY RETAINER WORKS:

  • 40% cost savings vs. hourly project work
  • Consistent security oversight as you scale
  • No sticker shock when emergencies arise
  • I become familiar with your systems over time
  • Faster responses because I know your context
  • Predictable monthly expense for budgeting

RETAINER OPTIONS:

Starter Plan: $4,500/month
  • 30 hours per month
  • 8-hour SLA for urgent issues
  • Monthly check-in call
  • Perfect for early-stage startups
Standard Plan: $9,000/month
  • 60 hours per month
  • 4-hour SLA for urgent issues
  • Bi-weekly strategy calls
  • Quarterly security reporting
Premium Plan: $13,500/month
  • 90 hours per month
  • 2-hour SLA for urgent issues
  • Weekly strategy calls
  • Quarterly reporting + annual security roadmap

All retainers include direct Slack/email access and rollover of up to 5 unused hours per month.

TIMELINE:
INVESTMENT:

* Price is an estimate and can be customized based on scope

📝

Security Code Review Service

WHO THIS IS FOR:

Companies needing focused security review of critical code before deployment, third-party integrations, or high-risk features. Get expert eyes on specific code sections without a full audit.

WHAT'S INCLUDED:

  • Deep-dive review of specified code sections
  • Detailed vulnerability report with severity ratings
  • Remediation recommendations with code examples
  • 2-week re-review after fixes implemented
  • Developer Q&A session

DELIVERABLES:

  • Security findings report with severity classifications
  • Code-level remediation guidance
  • Best practices recommendations
  • Re-review validation report

TYPICAL RESULTS:

  • Identified critical vulnerabilities before production deployment
  • Prevented security issues in high-risk integrations
  • Improved code security posture with actionable feedback
TIMELINE: 1-2 weeks (depending on codebase size)
INVESTMENT: $2,000 - $9,000

Small Review: $2,000 (up to 5,000 LOC) | Medium Review: $5,000 (up to 15,000 LOC) | Large Review: $9,000 (up to 40,000 LOC)

* Price is an estimate and can be customized based on scope

🏗️

Security Architecture Consulting

WHO THIS IS FOR:

Startups building MVP with security from day one, companies scaling beyond initial architecture, or businesses preparing for compliance audits. Get Amazon-proven frameworks adapted to your business.

WHAT'S INCLUDED:

  • Pre-session assessment questionnaire
  • 1-3 days intensive sessions (on-site or virtual)
  • Custom security architecture diagram
  • Threat modeling for your specific use case
  • Implementation roadmap with prioritized phases
  • 30-day follow-up support

DELIVERABLES:

  • Security architecture document with diagrams
  • Threat model specific to your system
  • Prioritized implementation roadmap
  • Security framework recommendations
  • Compliance alignment strategy (if applicable)

TYPICAL RESULTS:

  • Built security foundation before scaling issues arise
  • Passed compliance audits with architecture already in place
  • Enabled faster development with clear security patterns
TIMELINE: 1-3 days (intensive sessions)
INVESTMENT: $4,000 - $11,000

Strategy Session: $4,000 (1 day, virtual) | Deep Dive: $7,500 (2 days, comprehensive) | Enterprise Package: $11,000 (3 days, on-site)

* Price is an estimate and can be customized based on scope

👥

Security Training & Workshops

WHO THIS IS FOR:

Development teams needing security education, companies preparing for compliance, or organizations building security culture. Move from reactive to proactive security with hands-on training.

WHAT'S INCLUDED:

  • Custom content tailored to your tech stack
  • 4-8 hour interactive workshop (virtual or on-site)
  • Hands-on exercises and real-world scenarios
  • Workshop materials and reference guides
  • 30-day Q&A support after training
  • Certificate of completion for participants

WORKSHOP TOPICS:

  • Secure Coding Fundamentals (OWASP Top 10)
  • IAM & Access Control Best Practices
  • API Security & Authentication
  • Cloud Security (AWS/GCP/Azure)
  • Incident Response Tabletop Exercises
  • Security for AI/ML Systems

DELIVERABLES:

  • Custom training materials and slides
  • Hands-on lab exercises
  • Reference documentation
  • Post-training assessment

TYPICAL RESULTS:

  • Reduced security vulnerabilities in code reviews
  • Improved team security awareness and practices
  • Built security champions within development teams
TIMELINE: 4-8 hours (half-day to full-day)
INVESTMENT: $2,500 - $6,000

Half-Day Workshop: $2,500 (4 hours, up to 15 participants) | Full-Day Workshop: $4,500 (8 hours, up to 20 participants) | Multi-Day Program: $6,000+ (custom, 2-3 days)

* Price is an estimate and can be customized based on scope

💼

Fractional CISO Services

WHO THIS IS FOR:

Series A/B companies needing security leadership, businesses pursuing compliance certifications, or organizations scaling security programs. Get part-time Chief Information Security Officer expertise without full-time salary.

WHAT'S INCLUDED:

  • 20-80 hours per month of senior security leadership
  • Security program development and oversight
  • Vendor security assessments
  • Board-level security reporting
  • Compliance roadmap and audit support
  • Security policy and procedure documentation
  • Incident response leadership
  • Strategic planning and budgeting

DELIVERABLES:

  • Security program strategy and roadmap
  • Board-ready security reports
  • Compliance documentation and policies
  • Vendor assessment reports
  • Quarterly security posture assessments

TYPICAL RESULTS:

  • Achieved compliance certifications (SOC 2, ISO 27001, HIPAA)
  • Built security programs from scratch
  • Passed investor due diligence security reviews
  • Reduced security incidents through proactive leadership

RETAINER OPTIONS:

Advisor Tier: $6,500/month
  • 20 hours per month
  • Strategic guidance and oversight
  • Bi-weekly strategy calls
  • Quarterly board reports
Strategic Tier: $11,000/month
  • 40 hours per month
  • Program oversight and execution
  • Weekly strategy calls
  • Monthly reports + quarterly board updates
Embedded Tier: $18,000/month
  • 80 hours per month
  • Hands-on leadership and execution
  • Multiple weekly touchpoints
  • Weekly reports + monthly board updates

All retainers include direct access via Slack/email and first priority for overflow work.

TIMELINE: 6-12 month minimum engagement
INVESTMENT: $6,500 - $18,000/month

(6-12 month minimum) | Includes: Security leadership, program development, compliance support, and board reporting

* Price is an estimate and can be customized based on scope

📞

Emergency Security Hotline

WHO THIS IS FOR:

High-availability SaaS platforms, healthcare and financial services companies, businesses handling sensitive customer data, or organizations with regulatory response requirements. Get 24/7 access to incident response expertise.

WHAT'S INCLUDED:

  • Dedicated emergency phone number
  • 2-hour response SLA for critical incidents
  • Unlimited non-emergency security consultations
  • Monthly security check-in call
  • Access to incident response playbooks
  • Post-incident analysis and reporting

DELIVERABLES:

  • Incident response documentation
  • Post-incident analysis reports
  • Updated response playbooks
  • Security recommendations from incidents

TYPICAL RESULTS:

  • Reduced incident response time by 60%
  • Contained security incidents before major impact
  • Improved incident response processes through expert guidance
TIMELINE: 24/7 availability
INVESTMENT: $1,500/month retainer + $190/hour incident response

Monthly Retainer: $1,500 (reserves your spot, includes consultations) | Incident Response: $190/hour (only when activated) | Average Total: $2,000-3,500/month

* Price is an estimate and can be customized based on scope

Which Service Is Right For You?

Your SituationRecommended ServiceInvestmentTimeline
"I need quick advice on a specific security decision"Security Advisory Session$5001 session
"I want to learn security engineering from an expert"Technical Security Mentorship$150-$300/moOngoing
"We need basic security feedback before launching"Rapid Security Review$2,5001 week
"We need security review of specific code before deployment"Security Code Review$2K-$9K1-2 weeks
"We're preparing for investor due diligence"Security Audit & Compliance$12K-$35K2-4 weeks
"We need security architecture designed from scratch"Security Architecture Consulting$4K-$11K1-3 days
"Our permissions system is becoming unmaintainable"IAM & Access Control$14K-$45K3-5 weeks
"We waste too much time on manual security work"Security Automation$15K-$55K4-6 weeks
"We're building AI-powered features"AI/ML Security$18K-$60K3-5 weeks
"We suspect a security breach"Incident Response$6K-$18KImmediate
"We need security training for our development team"Security Training & Workshops$2.5K-$6K4-8 hours
"We need ongoing security support"Security Retainer$4.5K-$13.5K/moMonthly
"We need part-time security leadership"Fractional CISO$6.5K-$18K/mo6-12 months
"We need 24/7 emergency security access"Emergency Security Hotline$1.5K/mo + $190/hr24/7

Need Something Different?

Every business has unique security challenges. If your needs don't fit a standard package above, let's discuss a custom engagement.

Additional areas I work in:

Application security reviews and penetration testing
Cloud security architecture (AWS, Azure, GCP)
Security training and team enablement
Data pipeline security and governance
Compliance program development
Third-party security assessments
Security tool evaluation and selection
Technical security advisory (fractional CISO work)

I'll work with you to define scope, deliverables, timeline, and pricing that fits your situation.

Common Questions

Q: Do you work with my tech stack?

A: I specialize in AWS, Python, JavaScript/Node.js, PostgreSQL, and most modern development stacks. I'm technology-agnostic and comfortable learning what's needed. If you're using something unusual, let's discuss—I've worked with everything from cutting-edge AI frameworks to legacy mainframe systems.

Q: Can you start immediately?

A: It depends on current project commitments. Typical lead time is 1-2 weeks for new engagements. Emergency incident response can often be prioritized within 24 hours. Retainer clients get immediate priority access.

Q: What if the scope changes mid-project?

A: We'll establish clear milestones and check-ins. If scope changes, we handle it through a transparent change order process—you'll always know what you're paying for and why. No surprise bills.

Q: Do you offer payment plans?

A: Yes. Standard terms for project work are 50% upfront, 50% on delivery. For larger engagements over $20K, we can structure milestone-based payments. Retainers are invoiced monthly in advance.

Q: Do you sign NDAs and work under contract?

A: Absolutely. Your security concerns and business details stay confidential. I'll sign your NDA or we can use mine. All work is done under a clear contract with defined scope, deliverables, and terms.

Q: Do you work onsite or remote?

A: Primarily remote, which keeps costs down for you. I'm based in Arlington, VA and can meet onsite for initial kickoffs or critical sessions if you're in the DC/Northern Virginia area.

Q: What if we're not a good fit?

A: I'll tell you honestly in our first conversation. If I'm not the right person for your needs, I'll likely know someone who is and can make a referral.

Q: Do you have experience with [specific compliance standard]?

A: I've worked extensively with SOC 2, HIPAA, and GDPR requirements, particularly at Amazon where compliance was critical. If you need specialized expertise in CMMC, PCI-DSS, or other frameworks, I can advise or bring in a specialist partner.

Q: What happens after the project ends?

A: Every engagement includes a support period (typically 2-4 weeks) for questions and minor adjustments. After that, you own all deliverables and documentation. Many clients convert to retainers for ongoing support.

Q: How do you communicate progress?

A: Weekly status updates minimum, plus async updates via Slack/email as needed. For longer engagements, bi-weekly check-in calls. You'll always know what's been done, what's next, and if there are any blockers.

Ready to Get Started?

Schedule a free 20-minute consultation to discuss your security needs. No obligation, no sales pressure—just an honest conversation about your challenges and how I can help.