Security & Compliance Solutions for Regulated Industries

Series B SaaS unlocks enterprise deals

Delivered SOC 2 Type II + ISO 27001 in 9 months, unblocking $12M in stalled enterprise pipeline and passing 40+ customer security reviews.

Secure SDLC for multi-tenant platform

Embedded SAST/DAST, IaC scanning, and threat modeling into GitHub Actions — reduced critical vulnerabilities in prod by 78%.

Vendor questionnaire automation

Built a Trust Center + AI-assisted RFP responder that cut security review turnaround from 3 weeks to 48 hours.

Mid-size bank NYDFS Part 500 uplift

Redesigned CISO reporting, 3rd-party risk, and MFA controls ahead of DFS exam — zero matters requiring attention issued.

SOX ITGC rationalization

Cut ITGC control count 42% via key-control mapping and automation, saving ~4,000 audit hours annually.

Wealth manager PCI + privacy

Delivered PCI DSS 4.0 SAQ-D and California/Colorado privacy alignment for a $30B AUM RIA.

Foundation-model provider ISO 42001

Built AI Management System from scratch — model cards, evals, red-teaming, and incident response — achieving ISO 42001 certification as an industry first.

Enterprise LLM prompt-injection defense

Architected guardrails, tool-call sandboxing, and continuous adversarial evals for a copilot serving Fortune 500 legal teams.

EU AI Act high-risk system readiness

Classified 22 AI use-cases, produced conformity assessment package, and stood up post-market monitoring for a EU-headquartered SaaS.

Global manufacturer IT/OT segmentation

Rolled out Purdue-model segmentation, passive OT monitoring, and unified IR playbooks across 12 plants in 4 countries.

Tier-1 auto supplier TISAX AL3

Achieved TISAX Assessment Level 3 covering prototype and data protection — retained contracts with 3 European OEMs.

Ransomware recovery + resilience

Led post-incident recovery for a plastics manufacturer; rebuilt Active Directory tier model and cut RTO from 14 days to 36 hours.

Omnichannel retailer PCI 4.0 migration

Migrated 1,800 stores from PCI 3.2.1 to 4.0 with tokenization and P2PE, cutting audit scope 94% and annual assessment cost by half.

DTC brand privacy program

Deployed consent management, DSR workflow, and cookie governance across US, EU, and UK — closed 3 regulator inquiries with no penalty.

Magecart / e-skimming defense

Implemented SRI, CSP, and client-side monitoring on checkout — detected and blocked 2 supply-chain script attacks in first 90 days.

IaaS provider CSA STAR Level 2

Delivered CSA CCM mapping and STAR Level 2 attestation alongside SOC 2 and ISO 27017/27018 in a single unified audit cycle.

Managed hosting FedRAMP Moderate

Sponsored FedRAMP Moderate ATO for a hosting provider serving 40+ federal agencies; continuous monitoring runbooks now fully automated.

Multi-tenant isolation assurance

Engineered tenant-isolation proofs (control-plane + data-plane) and independent penetration testing to support largest-customer procurement.

P&C carrier NAIC Model Law program

Built information security program aligned to the NAIC Insurance Data Security Model Law across 14 state filings.

Health insurer HIPAA + HITRUST

Combined HIPAA Security Rule uplift with HITRUST r2 certification for a regional health plan covering 1.2M members.

Broker M&A cyber diligence

Ran 22 cyber due-diligence assessments across acquisition targets; identified 4 material issues before close.