Example profile. The name and every detail on this page are invented, to show what a profile for an individual consultant looks like. Consultants choose this layout or a simple one-card layout, at the same price. Get a profile like this
About
I help software companies get through their first ISO 27001 certification or SOC 2 report without buying more than they need. Before going independent I ran the security program at a 400-person SaaS company through three certification cycles, and before that I spent four years on the other side of the table as an IT auditor.
I write policies people actually follow, set up the evidence your auditor will ask for first, and sit in on the audit itself. I work alone and take two or three clients at a time, so you work with me directly from the first call to the auditor's last question. If what you already run does the job, I will tell you.
Services
- Fixed-fee project
- ISO 27001 readiness from $8,500
- Hourly
- $140 an hour
- Retainer
- From $2,000 a month for two days
Standards experience
Audit experience
| Audit | Their role | Count | Most recent |
|---|---|---|---|
| ISO 27001 certification, stage 1 and stage 2 | Led the audit for the company being audited | 9 | 2026 |
| ISO 27001 surveillance and recertification | Led the audit for the company being audited | 12 | 2026 |
| ISO 27001 internal audit | Internal auditor | 10 | 2026 |
| SOC 2 Type I | Readiness lead, worked alongside the CPA firm | 4 | 2025 |
| SOC 2 Type II | Readiness lead and evidence owner | 7 | 2026 |
Sectors: B2B software, fintech and health tech. References available on request.
Work experience
- 2022 to nowIndependent consultantISO 27001, SOC 2 and privacy work for 17 software companies.
- 2017 to 2022Information security manager, B2B SaaS company (about 400 employees)Built and ran the security program through three ISO 27001 cycles and the first two SOC 2 Type II reports.
- 2013 to 2017IT auditor, regional accounting firmIT general controls testing for SOX clients and SOC 1 engagements.
Tool experience
| Tool | Type | Experience |
|---|---|---|
| Vanta | Compliance automation | Set up for 6 clients |
| Drata | Compliance automation | Set up for 4 clients |
| Secureframe | Compliance automation | Used with 1 client |
| Jira and Confluence | Tickets and documents | Daily use |
| AWS (IAM, CloudTrail, Config) | Cloud | Evidence collection, configuration review |
| Microsoft 365 and Entra ID | Identity and productivity | Configuration review |
| Okta | Identity | Access reviews |
| Google Workspace | Identity and productivity | Configuration review |
Credentials
- CISA, Certified Information Systems AuditorISACAOn the ISACA register, checked September 27, 2026 ↗
- ISO/IEC 27001 Lead AuditorPECB
- CISSP, Certified Information Systems Security ProfessionalISC2
Who they work with
- Company size
- 20 to 600 employees
- Industries
- B2B software, fintech, health tech
- Regions
- United States, United Kingdom and the European Union, remote
- On site
- Colorado and neighboring states
- Languages
- English (native), Spanish (working)
Open to work
- Roles
- Fractional or interim security and compliance lead, GRC manager, contract ISO 27001 implementer
- Work types
- Contract, fractional, full-time
- Location
- Remote in the United States, or hybrid in Denver
- Available
- From October 12, 2026: 20 hours a week now, full time from January 2027
- Authorized to work in
- United States
Writing and talks
- A 30-day ISO 27001 evidence checklist ↗Article
- SOC 2 for a 20-person company: what to skip ↗Conference talk, 2025
Get a profile like this.
$5 a monthbilled yearly, $60
- Your photo, links, services and published prices
- Standards, audit, tool and work experience
- Availability and the roles you are open to, for clients and employers
- One page to link from your website, email signature and proposals, with a badge for each
- Credentials you name are checked against the issuer's public register where one exists
Prefer something shorter? The simple layout is one card with your photo, standards, services and contact buttons, at the same price.
You are listed in the directory free either way; the profile is the extra page.
Ask about a profile →