I build and run the security and engineering function — then rent it to founders without the full-time hire.

Tell me what you're building, what's breaking, or what decision you're sitting on. I'll tell you honestly whether and how I can help. No pitch, no slides.

If the intro call points toward an engagement, I'll send a short scope doc within 48 hours. It covers what I'll do, what I won't do, how we'll measure success, and what it costs. No ambiguity, no surprises.

Retainers start with a structured onboarding session and a running async doc for context and decisions. Embedded work starts with a codebase triage and a shared milestone plan. You get real availability, not calendar roulette.

What's the difference between a fractional CTO, fractional VP Eng, and fractional CISO?

Three different jobs that get bundled together because the titles all start with the same word. A fractional CTO sets technical direction for the org — what to build, what to buy, where the architecture is going in two years. A fractional VP of Engineering runs delivery and the team — sprint cadence, hiring bar, on-call rotation, the day-to-day of shipping. A fractional CISO owns security and compliance — SOC 2, IAM, incident response, the security questionnaire that just landed. I do VP-of-Engineering and CISO work. CTO work I scope case-by-case, usually as a Technical Assessment rather than an ongoing retainer — the role is high-leverage when it fits and a waste of everyone's money when it doesn't. If you're not sure which one you need, that's the intro call. I'll tell you which it is — or that it's none of these — within 30 minutes.

What does a typical engagement look like?

Most start with a 30-minute intro call, then a short written scope doc covering objectives, deliverables, and time commitment. Advisory retainers run month-to-month with 30 days notice to wind down. Embedded work is milestone-scoped upfront.

What does a fractional CISO actually do?

Weeks 1–2: scope the engagement, inventory the controls you already have, and rank the gaps by audit-blocking severity. Weeks 3–8: build out the missing pieces — IAM, MDM, vulnerability management, the policy pack — and stand up the AI-native security layers most pre-Series-A teams don't have yet (credential scoping, prompt-injection defense, audit logging). Weeks 9–12: documentation, evidence collection, auditor fieldwork, and the security questionnaires that have been sitting in your CTO's inbox. Ongoing after week 12: incident response when something happens, vendor reviews when you sign a new tool, and the next security questionnaire that lands.

What's your typical rate?

For context: a full-time CISO at a pre-Series-A AI company runs $200K–$400K loaded, plus equity, plus a 3–6 month time-to-hire. A security consultant billing hourly runs $250–400/hour with no ongoing ownership. Advisory retainers start at $3,500/month for 4–8 hours. Fractional security leadership starts at $2,500/month. Embedded engineering is scoped at a weekly rate depending on commitment and duration. All engagements are scoped before we start — no surprise overages, no retainer creep. If the work exceeds the scope, we re-scope in writing before I do the work.

When should I switch from a fractional CISO to a full-time hire?

Four signals, any one of which tips the math. (1) Security work is consistently exceeding 20 hours a week — past that, fractional stops being cheaper than full-time. (2) You're post-Series A with a security-conscious customer base and the security executive needs to be on the org chart, not on a contract. (3) The engineering org has crossed roughly 50 engineers and security needs a permanent seat in planning. (4) You're pursuing a regulated deal (FedRAMP, HIPAA at scale, payments) that requires a named full-time executive on the agreement. Most fractional CISO engagements graduate at month 9–14. That's the goal — not the failure mode. If I'm still your on-call security executive at month 18 without one of those four signals firing, I've failed the engagement.

What does the first 30 / 60 / 90 days look like?

Day 30: scope locked, controls inventory complete, the policy pack drafted and signed, one quick win shipped (usually credential scoping for the highest-blast-radius service accounts). Day 60: gap-closure work in flight, evidence collection running in the compliance tool, the first enterprise security questionnaire answered cleanly without the CTO writing it. Day 90: ready for auditor fieldwork or the Series A security review, depending on what triggered the engagement.

Are you available right now?

I maintain a small number of active engagements at a time to ensure real availability. Book the intro call — if I'm fully committed, I'll say so directly and we can plan around it.

Do you work with early-stage companies that can't yet afford a full staff engineer?

Yes. Advisory retainers are specifically designed for this. Six hours of operator-level guidance per month on architecture, hiring decisions, and technical risk is often exactly what a seed-stage team needs before they can justify a full-time hire.

What's included in a fractional engagement, and what's billed separately?

Included: the scoped hours each month, async support over Slack or email during the engagement, every deliverable I produce (scope docs, policies, runbooks, architecture decisions, the written report at the end of an assessment), and an operator's judgment on every escalation that lands during the month. Billed separately or out of scope: penetration-test engagements (referred to specialist partners, not run by me), tooling subscriptions like Vanta, Drata, or SIEM vendors (paid by you directly, since you'll own them after I'm gone), travel for the rare on-site week, and any work past the retainer band. No retainer creep. If the work exceeds the scope, we re-scope in writing before I do the work — never after.

What's the best way to start?

Book the 30-minute intro call. Come with the specific problem you're trying to solve — not a job description, but the actual situation: what's breaking, what you're building, what's blocking you. We'll figure out from there whether and how I can help.