06 · Advisory
Virtual CISO
Security leadership without a six-figure hire.
A named senior security lead who owns your programme: maintains the certification, answers customer security questionnaires, sits in enterprise security reviews, reports to your board, and keeps the roadmap honest.
The context
Why this matters
Between 20 and 200 people, most SaaS companies need security leadership long before they can justify a full-time CISO. The work lands on a founder or a staff engineer who already has a job, and it degrades into reactive questionnaire-answering.
A virtual CISO engagement gives you a named person accountable for the programme, in your Slack, at your leadership meetings, and on the call when an enterprise prospect's security team wants to talk to someone who owns this.
It is deliberately structured to be temporary. When you are ready to hire in-house, we help write the role, interview candidates, and hand over a programme that is documented rather than living in one person's head.
What is covered
Scope of the engagement
- 01
Security programme ownership
A maintained roadmap with measurable objectives, tracked risk register, and a named accountable owner for each initiative.
- 02
Customer security reviews
We answer security questionnaires, complete CAIQ and SIG assessments, and join enterprise prospect security calls as your security lead.
- 03
Certification maintenance
Annual internal audit, management review, risk refresh and surveillance audit preparation so your ISO 27001 or SOC 2 stays current.
- 04
Incident response readiness
A tested incident response plan, defined roles, tabletop exercises, and a communications plan for customers and regulators.
- 05
Vendor risk management
A workable third-party review process, proportionate to vendor criticality, not a 90-question form for every SaaS subscription.
- 06
Board & leadership reporting
Quarterly reporting that expresses security posture in terms a board can act on, rather than a vulnerability count.
What you receive
Deliverables
Everything below is included in the fixed price. Nothing here is an upsell discovered halfway through.
- Named senior security lead with defined availability
- Maintained security roadmap and risk register
- Completed customer security questionnaires and CAIQ/SIG responses
- Tested incident response plan and tabletop exercise reports
- Quarterly board-level security reporting pack
- Handover documentation when you hire in-house
Questions
Virtual CISO FAQ
Retainers are sized in days per month, commonly two to six, with a named lead rather than whoever is free that week. We agree response expectations up front, including availability during a live incident.
That is the intended outcome. We help scope the role, screen candidates if you want us to, and hand over a documented programme. Many clients keep us on at a reduced level for the first few months so the new hire inherits context rather than a mess.
Often paired with
ISO 27001 Certification
End-to-end ISO 27001 implementation: gap analysis, ISMS build, evidence and audit support, right through Stage 2.
Read more02SOC 2 Readiness
Type I and Type II readiness: control design, evidence discipline and auditor coordination, without the busywork.
Read more03Penetration Testing
Manual testing of web apps, APIs, mobile clients and authentication flows, with a report your engineers can act on.
Read moreKnow exactly what an auditor, and an attacker, would find.
Tell us what you need certified or tested. We will scope it properly, quote a fixed price, and tell you honestly if the timeline you have in mind is realistic.
No sales sequence. A scoping call and a written proposal cost nothing.