AP

SOC 2 • Security • IT

SOC 2 for startups, without hiring a security or IT team.

I was the only person covering security, compliance and IT at a Series B SaaS company. I fixed device management, rolled out endpoint protection, rewrote the policies, built the controls and took the company through a SOC 2 Type II audit in under 12 months. Now I help startups do the same, part-time, so you get there faster and stay compliant as you grow.

Book a free 30-minute SOC 2 gap call See the work
45 → 95% SOC 2 readiness within six months Measured in Drata
~1,950 critical and high findings closed in two weeks Measured in Datadog
$85K / mo secrets platform savings after hosting costs Vault on AKS
$1M+ cloud and tooling spend removed Across two environments

01 • Selected work

What I accomplished, how it was measured, and what I did.

Every entry follows the same shape: the outcome, the measure, the work. Company names and sensitive implementation details are omitted.

01 — Security program · Series B SaaS

Took a Series B SaaS company from 45% to 95% SOC 2 readiness in six months.

Raised SOC 2 readiness from 45% to 95% within six months and carried the audit through to a final Type II report in August 2026, measured in Drata and by the issued report, by building the technical controls, device compliance, evidence processes and training as the sole internal security owner. Passing the audit helped bring in enterprise customers.

45 → 95%Drata readiness, six months
Read the case study

My ownership

I joined in late September 2025, when there was no dedicated IT function, and owned the security program, partnering with engineering, PeopleOps, and independent auditors. I implemented fixes directly and escalated changes requiring product or engineering ownership to the responsible managers.

Controls that operated in practice

I built infrastructure controls and automation to detect changes to them, updated policies to reflect actual practices, completed device enrollment in MDM, enforced device compliance, strengthened AWS least-privilege access, and implemented security training for users.

Evidence and remediation

I established evidence-collection processes and human code-review requirements, coordinated penetration testing and remediation, and worked with auditors to identify and close gaps before the audit.

The timeline and result

Drata readiness increased from 45% to 95% within six months. This was the platform’s readiness metric, not an auditor-issued compliance score. The Type II observation period ran from January 1 to March 31, 2026, and the final report was issued in August 2026.

02 — Secrets infrastructure · AKS

One source of truth for secrets, $85K cheaper every month.

Cut secrets-platform spend by $85,000 a month, measured after hosting costs, by consolidating Azure DevOps, GitHub, Azure Key Vault and Vault Enterprise into self-hosted Vault on AKS, with Terraform-managed identities, private endpoints, New Relic alerting and tested restores.

$85Ksaved monthly, after hosting costs
Read the case study

The consolidation

Secrets were spread across Azure DevOps, GitHub, Azure Key Vault, and HashiCorp Vault Enterprise. I migrated them into self-hosted Vault as a single source of truth and integrated all services with the new platform.

Identity and network controls

I used dedicated service principals managed through Terraform for authentication, with private endpoints restricting network access to the platform.

Monitoring and detection

Audit events were sent to New Relic. I configured monitoring and alerts for unauthenticated access attempts, unused secrets, and unused identities.

Backups and recovery

Regular backups were stored in Azure Blob Storage accessed through a private endpoint. We tested restoration from multiple backups to verify recovery.

The result

The migration consolidated secrets and service integrations on one platform, with monitoring and tested recovery. Savings were $85,000 per month after hosting costs.

03 — Vulnerability remediation

Two weeks from ~1,950 open critical and high findings to zero.

Brought open critical and high-severity findings from roughly 1,950 to zero in two weeks, as shown in Datadog, by personally upgrading dependencies and removing unused code across repositories, grouped into consolidated pull requests with code-owner approval. Eighteen upstream findings without a fixed version were suppressed for 30 days and tracked as exceptions, not fixes.

0 opencritical or high findings after 14 days
Read the case study

The workload

Datadog displayed the backlog as a rounded 1.95k findings, with approximately 480 rated critical and the remainder high. These were not duplicates. Another 26 findings arrived during the final week, so the reported volume is approximate rather than an exact count of code fixes.

My implementation

I personally made the code changes, upgrading dependencies and removing unused code. I grouped fixes into consolidated pull requests by repository and severity, reducing review requests from hundreds to tens per repository while retaining code-owner approval for every change.

Testing and review

I verified feature behavior through local deployments. Claude assisted with running CI tests locally, checking repository code-quality guidelines, and managing Jira tickets. Code owners reviewed and approved the changes before merging.

Time-bound exceptions

Eighteen findings involved upstream libraries without fixed versions. These were suppressed for 30 days and required monthly reassessment. They were tracked as exceptions, not counted as code fixes.

The verified outcome

After the changes, Datadog showed zero open critical or high-severity findings. That dashboard state included the 18 temporary suppressions; it does not mean every finding had an available patch or that the systems were free of vulnerabilities.

04 — Software delivery security

Risk review became a required merge check.

Stopped high and critical-risk changes from merging through the normal workflow, enforced as a required CI status check, by building a review bot that classifies each change’s risk and assesses the guardrails it touches. Warnings notify the reviewer; destructive permission requests are blocked and code owners are notified.

RequiredCI status check on every merge
Read the case study

The enforcement

I defined the blocking criteria for a required CI check. High and critical classifications fail the check and prevent merging through the normal workflow. Warnings pass but notify the reviewer; green results pass. Destructive permission requests are blocked and code owners are notified.

The exception path

After identifying a gap in the check, we updated it to accept exceptions requested by repository admins with explicit resource and time restrictions. Ordinary requesters cannot authorize those exceptions. Policy conditions enforce the permission time limit.

The boundary of the control

The required check enforces the classifier’s risk status. It does not independently prove the classifier’s assessment is correct. Human review remains part of the merge process.

05 — Application authorization

Applications lost the schema privileges they never needed.

Separated application data access from schema administration, enforced through distinct RDS grants and identities, by reserving schema changes for a dedicated GitHub Actions identity and splitting the configuration across separate repositories and OpenTofu workspaces. Backups and secondary databases became read-only.

Splitdata access vs. schema changes
Read the case study

The boundary

For RDS, I implemented database grants that allow application identities to read and write primary database data while reserving schema alterations for a dedicated GitHub Actions identity. Access to backups and secondary databases was limited to read-only.

The implementation

The configurations are managed in separate repositories and OpenTofu workspaces to reduce accidental changes across that boundary. Schema changes run through the delivery workflow so their history can be tracked.

My role

I originally implemented these permission changes myself. I now use Claude Cowork to automate changes, with human review required before merging. Related reviews caught application access that could write secrets when only read access was needed, and database credentials embedded in application code before production.

The result

Application data access and schema administration use separate identities and privileges. Database grants enforce the RDS query and schema boundary; AWS permissions govern infrastructure access.

06 — Incident access

Incident access scoped to one queue, for a limited time.

Unblocked a stuck-queue incident without granting standing delete rights, recorded as a documented, policy-enforced time limit on a single queue, by having the administrator scope their bypass authority to the affected resource instead of widening permanent access.

1 queuetime-boxed by policy conditions
Read the case study

The response

An administrator used their bypass authority to enable the incident action. The permission was scoped exclusively to the affected queue and limited in time through policy conditions, rather than becoming permanent access.

The audit record

The event was documented for auditability. This was a separate incident from the repository-admin exception path described in the CI case study.

The wider practice

My AWS IAM work includes risk classification and periodic permission reviews for indirect escalation paths. I use account-level SCPs to restrict sensitive AWS actions and privileged access across environments that include RDS and DynamoDB.

07 — Cloud efficiency

Seven figures of cloud and tooling spend removed.

Reduced cloud and tooling costs by more than $1M across two environments, by rightsizing, restructuring infrastructure, automating operations and choosing open-source replacements where they fit, without trading away security or reliability.

$1M+across two environments

02 • How I work

Security should create guardrails that help teams ship, not gates that make them wait.

  1. 01

    Automate the controls

    Permission boundaries, pre-merge risk checks and drift detection enforce the policy, so it holds without a review queue.

  2. 02

    Make ownership clear

    I fix what I can fix directly. Changes that need product or engineering ownership go to the responsible managers, not a ticket backlog.

  3. 03

    Embed champions

    Security champions across the business carry the program further than one owner can, and keep it running when priorities shift.

  4. 04

    Keep human judgment

    A required check enforces a classifier’s verdict; it does not prove it right. Human review stays in the merge path where it matters.

03 • Engagements

How we’d work together.

Pick a one-time engagement, or a long-term retainer to stay compliant as you grow.

01

Readiness assessment

A fixed-fee gap assessment against SOC 2, ending in a prioritized roadmap.

One-time Fixed fee

02

Implementation

I build the controls, policies, device and identity setup, and engineering fixes, and coordinate the audit.

One-time Fixed fee, scoped after the assessment

03

Ongoing fractional security lead

A monthly retainer covering continuous compliance, customer security questionnaires, vendor reviews, access reviews and the annual audit.

Ongoing Monthly retainer

Also: AI security and governance, cloud and platform security, vulnerability management.

04 • Writing

Field notes from building the function.

Practical writing about security leadership, cloud infrastructure, AI governance, automation, and the decisions behind the systems.

Read all articles
  1. · 3 min readType 1 or Type 2? The SOC 2 Decision Nobody Explains Properly
  2. · 4 min readAI Writes Fast. Compliance Moves Slow. Somebody Has to Own the Gap.
  3. · 8 min readBreaking AI Agents: What a Vendor Chatbot Told Me It Shouldn’t Have - Part 01: Recon

05 • Contact

Your first security leader, part-time.

Looking for hands-on help? Let’s talk about your team, your priorities, and what needs to happen next.

For founders and teams

Fractional leadership, advisory work, and focused implementation engagements to build your foundations or close a specific gap.

Book a free 30-minute SOC 2 gap call Connect on LinkedIn GitHub