Security leadership, built around your risk.
A senior security leader on a fractional basis, for organisations that need senior security leadership without a full-time CISO, or extra senior capacity alongside the one they have. If something goes wrong, the same firm that wrote your plan runs your response.
- Founder-led
- ISACA CISM
- US & EU
- Reply within one business day
Track record
Results from senior security leadership at a NASDAQ-listed, GxP-regulated biotechnology company.
- HIPAA
- HITECH
- GDPR
- NIS2
- NIST CSF 2.0
- HITRUST
- ISO/IEC 27001
- SOC 2
- PCI DSS
- GxP
- NIST 800-53
We are usually called in for one of these.
A hospital, payer or enterprise customer has sent a vendor-risk questionnaire, and the deal is not moving until it is answered properly.
An audit is coming (SOC 2, ISO 27001 or HITRUST), or your cyber insurer wants named security leadership before renewal, and nobody can say with confidence what would be found.
The board or audit committee has started asking about cyber risk, and the answers so far have been technical rather than useful.
You run a US parent and an EU subsidiary, and HIPAA and GDPR obligations are currently being handled by two different firms.
Something has already happened, and you need someone who can establish what, prove it, and say so on the record.
You need a CISO’s judgement and accountability, but not a full-time CISO’s salary, and you want the same person on the worst day.
If more than one of these is true, start with the free 30-minute call.
Six service areas. One accountable lead.
From the first assessment to ongoing defence. The person who advises your board is the person who knows your environment on the worst day.
Governance, risk & compliance
A defensible programme your board, auditors and customers can trust.
Vulnerability & exposure management
Fix what attackers are actually using, first.
Incident response & security operations
Detect, respond and recover, with a plan people have rehearsed.
Cybersecurity assessments
Know where you stand before you invest.
Security strategy, roadmaps & vCISO
Turn findings into a plan, and a leader to own it.
Managed security & team augmentation
Senior expertise on tap, without building a department.
Frameworks: ISO 27001 · SOC 2 · PCI DSS · NIS2. Who we help by sector. Every engagement follows the same path: Assess where you stand, Build the programme, then Manage it month to month. How it works.
Start with a conversation. Go at your pace.
Most clients begin with a free call. From there, some want a quick, focused piece of work; others want a security leader on hand every month. Either way, it is agreed with you up front, with no surprises.
-
A free conversation
Tell us what is on your mind and get a senior second opinion on where to focus first. If you like, answer a short questionnaire beforehand so we can make the most of the time.
-
A focused first project
When you would like a quick, practical win, such as a posture review, a response rehearsal or a compliance readiness assessment (HIPAA, SOC 2, ISO 27001, PCI DSS or NIS2), with the scope and cost agreed before we begin.
-
An ongoing partnership
A fractional CISO or incident-response partner on hand when you need one, for one fixed monthly fee agreed together. No hourly meter.
One accountable lead, across every region and entity.
Not passed between firms. Whether you run a US parent with an EU subsidiary or a group with entities in several countries, the programme, policies and playbooks are written once and mapped to every jurisdiction, with governance from board to site level. This is where we do our best work.
Senior judgement, named and accountable.
Twelve-plus years across biotechnology, healthcare, financial services and federal government, from writing FISMA and NIST 800-53 frameworks to building a global, follow-the-sun security organisation for a publicly traded, GxP-regulated company.
Jonathan has served as incident commander for Sev-1 events, presented risk to executive leadership, contributed to board-level reporting and SEC disclosure readiness, and been security owner for enterprise AI rollouts. Forensics and incident response are delivered under his direction, engaged per client from a vetted specialist bench, so the same firm that built your plan runs your response.
What clients ask before the first call.
How does an engagement start?
With a free 30-minute security posture conversation: a senior second opinion on where your biggest security or compliance gap probably is. If it makes sense to continue, we agree the right next step together, whether that is a fixed-scope assessment, a fractional CISO retainer, an incident-response retainer, or a combination.
Is the first call really free?
Yes. It is a genuine thirty-minute conversation, not a sales demo. There is no cost and no obligation, and you leave it with a clear view of what to do first.
How is the work priced?
Ongoing work is scoped with you on the free call and agreed as a fixed monthly fee, so there is no hourly meter and no surprise on the invoice. If you want to move quickly, a few fixed-scope packages can be booked and paid online.
Do you handle both US and EU obligations?
Yes, in one practice rather than passed between firms: HIPAA and HITECH, state breach statutes and HHS Office for Civil Rights expectations on the US side; GDPR, NIS2 and member-state health rules on the EU side. Where a group runs a US parent and an EU subsidiary, the assessment, policy set and playbook are written once and mapped to both.
What happens if we have an incident?
Call or email with INCIDENT in the subject line. On a response retainer you get named responders and agreed engagement times rather than a queue: forensics to establish root cause, scope and dwell time; ransomware and email-compromise containment; evidence that stands up with counsel, insurer and regulator; and HIPAA/HITECH and GDPR notification analysis.
Something not answered here? Ask on the free call
Book your free 30-minute security posture conversation.
Tell us what is driving this. We will come to the call having read it, and leave it with a clear view of what is in scope and what to do first. No cost, no pitch.
- Founder-led
- ISACA CISM
- US & EU
- Reply within one business day