Security that accelerates business.
For growing companies selling to the enterprise.
22 Security is a boutique consultancy. Security advisory, compliance assessments, and penetration testing from one practitioner who has built the program, run the enterprise review, and shipped the product.
CISSP · CISM · CISA · CCSP · 8× AWS Certified
Services
Security advisory. Compliance. Penetration testing.
- 01
Security Advisory
Someone to run security while you hire, to help when an incident happens, and to find out whether your team would catch a real attack.
- Interim Security Lead
Customer reviews, audits, and security work don't pause while you hire. Filling the gap keeps them moving, and the hand-off gives your hire a running start.
Starts at $6,000 a month, for about one day a week
- Incident Response
An incident costs the most while it stays open. Closing it out with a report, a runbook, and guardrails gives customers, insurers, and auditors the documentation they will ask for.
Starts at $2,000
- Incident Response Retainer
Help starts from an environment already assessed, not a cold start. Hours not used on incidents go to readiness work, so the budget isn't wasted.
- Purple Team
You already pay for monitoring and detection tools. A purple team exercise shows whether they catch a real attack path, and what to tune when they don't.
- Interim Security Lead
- 02
Compliance
Where you stand against a compliance framework, from the outside and the inside, and what in your AWS accounts reaches your critical data.
- External Compliance Assessment
Enterprise security reviewers and cyber insurers often check what you expose to the internet before they ask you anything. Seeing it first means you fix it before it comes up in a deal or a renewal.
- Internal Compliance Assessment
Enterprise customers ask for a SOC 2 report or a completed security questionnaire before they sign. Finding the gaps first means you fix them on your schedule, not in the middle of a deal.
- AWS Security Assessments
Scanners hand engineering teams long lists sorted by vendor severity. Ranking findings by what reaches your critical assets puts engineering time on the fixes that matter first.
- External Compliance Assessment
- 03
Penetration Testing
How far an attacker can get: from the outside with nothing, from an ordinary account, or along every attack path in your AWS accounts.
- Penetration Test
Enterprise customers, vendor security reviews, and cyber insurance applications often ask for a recent third-party penetration test. The attestation letter is written to be shared with them.
Starts at $5,000
- Penetration Test
Why one practitioner
Vision, business sense, and the technical ability to pull it off.
I built the technology programs inside two successful startups full time, then assessed 171 more of them running third-party cyber risk at a Fortune 200 global bank. I know what the enterprise reviewer will ask because I was the assessor, and I know what your roadmap can absorb because I have shipped one. I am a security subject matter expert with a Master of Science in Finance. I also have an MBA and a CISSP. The recommendations I surface and the work I produce are always grounded in both the technical and the business side, since no function can succeed in a silo.
Track record
Certified on paper. Proven in production.
Healthcare Tech
A POC that won follow-on funding
I owned the backend and architecture of a patient-facing POC while another engineer built the front end. Because it handled real test results, I routed it through Bedrock and Claude rather than a direct third-party API, keeping protected health data inside our own AWS account, and used deterministic lookups so the model explained real results instead of guessing them. Existing investors saw the demo and committed more capital
Mergers and Acquisition
Acquired by our customer
I led our HITRUST r2 assessment from the inside: the gap assessment, remediating the controls that had to pass in each domain, and assembling the evidence for the assessors. That certification won customer trust and gave Optum, already one of our customers, the confidence in our systems to acquire us.
Startup Operations
Saved $1M per year in operations
At an MSSP serving startups, I redesigned how we handled customer equipment. I replaced shipping empty return boxes with QR-code UPS dropoffs, where an employee gets a box and a printed label on the spot, and moved laptop provisioning to zero-touch deployment straight from Apple with Jamf and Apple Business Manager. Together those changes cut roughly a million dollars a year.
Fortune 200 Financial Services
AI-assisted vendor assessments
Every assessment finding at the global bank must cite the exact internal policy line behind it, and confirm the policy applies to vendors rather than just internal teams. I built a Copilot-based notebook for the team grounded in dozens of policies that returned the citation in seconds instead of the old manual hunt. Assessments got faster, and the findings got harder to dispute.
How I work
Fixed fee, month to month, or prepaid hours.
Fixed fee
Assessments, penetration tests, purple team exercises, and interim projects, quoted after a scoping call. One-off incident response is priced by the size of the incident.
Month to month
Interim day-to-day work, from about one day a week, with no minimum term.
Prepaid hours
The incident response retainer, a block of hours for response when something happens and readiness work when nothing does.
Start with a conversation.
The right engagement depends on what you’re building and where the gaps are. A 30-minute call gets us to whether and how I can help.