Work with me.

Tell me what you're building, what's breaking, or what decision you're sitting on. I'll tell you honestly whether and how I can help. No pitch, no slides.

If the intro call points toward an engagement, I'll send a short scope doc within 48 hours. It covers what I'll do, what I won't do, how we'll measure success, and what it costs. No ambiguity, no surprises.

Retainers start with a structured onboarding session and a running async doc for context and decisions. Embedded work starts with a codebase triage and a shared milestone plan. You get real availability, not calendar roulette.

What's the difference between a fractional CTO, fractional VP Eng, and fractional CISO?

Three different jobs that get bundled together because the titles all start with the same word. A fractional CTO sets technical direction for the org — what to build, what to buy, where the architecture is going in two years. A fractional VP of Engineering runs delivery and the team — sprint cadence, hiring bar, on-call rotation, the day-to-day of shipping. A fractional CISO owns security and compliance — SOC 2, IAM, incident response, the security questionnaire that just landed. I do all three, and they price differently because they are different jobs. CTO work runs as an ongoing retainer when the decisions are continuous — you are choosing an AI stack, a platform, an architecture you will live inside for years — and as a one-time Technical Assessment when you need a single call made well and then you are fine. The retainer is the wrong purchase if your technical decisions are already settled; I will say so. If you are not sure which one you need, that is the intro call. I will tell you which it is — or that it is none of these — within 30 minutes.

What does a typical engagement look like?

Most start with a 30-minute intro call, then a short written scope doc covering objectives, deliverables, and time commitment. Advisory retainers run month-to-month with 30 days notice to wind down. Embedded work is milestone-scoped upfront.

What does a fractional CISO actually do?

Weeks 1–2: scope the engagement, inventory the controls you already have, and rank the gaps by audit-blocking severity. Weeks 3–8: build out the missing pieces — IAM, MDM, vulnerability management, the policy pack — and stand up the AI-native security layers most pre-Series-A teams don't have yet (credential scoping, prompt-injection defense, audit logging). Weeks 9–12: documentation, evidence collection, auditor fieldwork, and the security questionnaires that have been sitting in your CTO's inbox. Ongoing after week 12: incident response when something happens, vendor reviews when you sign a new tool, and the next security questionnaire that lands.

What's included in the Fractional Chief AI Officer engagement?

Owns how your company adopts AI, part-time, without a full-time executive hire. For an engineering team that means four things. Standardize the workflow, not the vendor: engineers can use whichever agent and model they prefer, because the tools trade places every few months, while the workflow, controls and measures stay fixed. Set the workflow: agents work on branches, never main, a human reviews and merges, and the handoff between agent sessions is written down instead of improvised. Put the controls in: managed permission settings a developer can't override, an allowlist for the MCP servers agents can reach, and an audit trail of what the agents did. Measure it: whether PR review time, PRs merged per week and tickets closed actually moved, rather than how many seats you bought. It runs as a month-to-month retainer at $3,500/month for 4–8 hours, the same shape as a fractional CTO, because the decisions are continuous: the tools change every quarter and the standard has to move with them.

How do you roll out coding agents like Claude Code across an engineering team safely?

Start with the controls, then widen access. First, a managed settings policy the developer can't override: denied reads for secrets, approval-skipping modes turned off, and only the hooks and MCP servers you've approved. Second, a review rule: agent-written code lands on a branch and a human reviews it before it merges, the tests always and the diff where the risk is, because the failure mode is code that compiles, looks reasonable and is subtly wrong. Third, an audit trail: Claude Code can emit telemetry that records whether a policy, a hook or a person approved each tool call, which is the evidence an enterprise security review asks for. Then pilot with a small group on real work, write down what the agents got wrong, and turn that into the team's written standard before everyone gets access. I'm a former CISO, so the security half of this isn't an afterthought; it's usually the part that unblocks the enterprise deal.

Can you help with a security questionnaire that's blocking a deal?

Yes. That's the Security Review Sprint: $3,000 fixed, five business days, one questionnaire up to 250 questions (SIG Lite, CAIQ or the buyer's own). Every answer is written to be true today and defensible on the follow-up call, because experienced reviewers read a wall of auto-filled "in progress" answers as risk, not progress. Where you don't have a control, the answer says what you do instead and when it closes. You also get the weak answers ranked by how much they could stall the deal, the AI-specific evidence your SOC 2 report wasn't scoped for, and a prep call before the buyer's security team follows up. It isn't an audit or an attestation, and I won't claim controls you don't have. If the gap list turns into a program, that's the Security Leadership retainer.

What's your typical rate?

For context: a full-time CISO at a pre-Series-A AI company runs $200K–$400K loaded, plus equity, plus a 3–6 month time-to-hire. A security consultant billing hourly runs $250–400/hour with no ongoing ownership. Advisory retainers start at $3,500/month for 4–8 hours, and so does the fractional Chief AI Officer retainer. Fractional security leadership starts at $2,500/month. A Security Review Sprint for one blocking questionnaire is $3,000 fixed. Embedded engineering is scoped at a weekly rate depending on commitment and duration. All engagements are scoped before we start — no surprise overages, no retainer creep. If the work exceeds the scope, we re-scope in writing before I do the work.

When should I switch from a fractional CISO to a full-time hire?

Four signals, any one of which tips the math. (1) Security work is consistently exceeding 20 hours a week — past that, fractional stops being cheaper than full-time. (2) You're post-Series A with a security-conscious customer base and the security executive needs to be on the org chart, not on a contract. (3) The engineering org has crossed roughly 50 engineers and security needs a permanent seat in planning. (4) You're pursuing a regulated deal (FedRAMP, HIPAA at scale, payments) that requires a named full-time executive on the agreement. Most fractional CISO engagements graduate at month 9–14. That's the goal — not the failure mode. If I'm still your on-call security executive at month 18 without one of those four signals firing, I've failed the engagement.

What does the first 30 / 60 / 90 days look like?

Day 30: scope locked, controls inventory complete, the policy pack drafted and signed, one quick win shipped (usually credential scoping for the highest-blast-radius service accounts). Day 60: gap-closure work in flight, evidence collection running in the compliance tool, the first enterprise security questionnaire answered cleanly without the CTO writing it. Day 90: ready for auditor fieldwork or the Series A security review, depending on what triggered the engagement.

Are you available right now?

I maintain a small number of active engagements at a time to ensure real availability. Book the intro call — if I'm fully committed, I'll say so directly and we can plan around it.

Do you work with early-stage companies that can't yet afford a full staff engineer?

Yes. Advisory retainers are specifically designed for this. Six hours of operator-level guidance per month on architecture, hiring decisions, and technical risk is often exactly what a seed-stage team needs before they can justify a full-time hire.

What's included in a fractional engagement, and what's billed separately?

Included: the scoped hours each month, async support over Slack or email during the engagement, every deliverable I produce (scope docs, policies, runbooks, architecture decisions, the written report at the end of an assessment), and an operator's judgment on every escalation that lands during the month. Billed separately or out of scope: penetration-test engagements (referred to specialist partners, not run by me), tooling subscriptions like Vanta, Drata, or SIEM vendors (paid by you directly, since you'll own them after I'm gone), travel for the rare on-site week, and any work past the retainer band. No retainer creep. If the work exceeds the scope, we re-scope in writing before I do the work — never after.

What's the best way to start?

Book the 30-minute intro call. Come with the specific problem you're trying to solve — not a job description, but the actual situation: what's breaking, what you're building, what's blocking you. We'll figure out from there whether and how I can help.