I work with a small number of clients at a time, mostly health tech and health AI companies and the executives and boards responsible for them. Every engagement is advisory. I help you build and lead the security, privacy and AI governance program; I don’t audit it, pen test it or run it as a managed service.
AI Governance & Agentic AI Security Readiness Sprint
For: teams shipping AI agents, copilots or MCP integrations, especially where PHI or other regulated data is in reach.
Format: fixed-scope project, typically 3–4 weeks.
- Inventory of models, agents, tools and data flows, including shadow AI
- Risk review against NIST AI RMF and the OWASP Top 10 for LLM and Agentic Applications
- Agent permissions, MCP and third-party integration review, with human-in-the-loop controls
- HIPAA Security Rule mapping where agents touch PHI
- Prioritized 90-day roadmap and an executive readout
Fractional CISO / vCISO
For: companies that need security leadership before they need a full-time CISO.
Format: monthly advisory retainer or hourly advisory.
- Security and privacy strategy, roadmap and budget
- Board and audit committee reporting
- Policy, vendor and customer security reviews
- Hiring plans and interviews for your first security leaders
Compliance Readiness Advisory
For: companies preparing for SOC 2, HIPAA, ISO 27001 or FedRAMP.
Format: discovery, then a milestone-based project or retainer.
- Gap analysis and a realistic timeline
- Control design, policies and evidence planning
- Auditor and GRC-platform selection support
I prepare you for the audit. I don’t perform it, so there’s no conflict of interest.
Executive AI Tooling Training
For: executives and leadership teams who want to use AI tools well and safely, not just hear about them.
Format: half-day or full-day, hands-on, on-site or virtual.
- Working sessions with tools like Claude, Gemini and ChatGPT on your team’s real tasks: briefs, analysis, drafting and review
- Safe-use guardrails: what data goes where, approval settings and verification habits
- A short acceptable-use playbook your team keeps afterward
Workshops & Training
For: security teams, professional associations and conferences.
Format: workshop, bootcamp or talk.
- AI governance and agentic AI security workshops with hands-on labs
- Security management bootcamps and certification prep (CISSP, CRISC)
- Keynotes and panels. See past presentations.
How engagements work
- Intro call (20 minutes, free): what you’re facing and whether I’m the right fit
- Scoped proposal: fixed-scope project, monthly retainer or hourly advisory, priced to the work
- Your data stays yours: you own every artifact we produce
Not offered: audits or assessments (SOC 2, HITRUST, PCI), penetration testing, or managed security services. I’m happy to refer you to firms that do this work.
