Senior security architecture, delivered independently.

Security architecture governance

Security designed in from ideation to delivery, and signed off with evidence.

• Secure by design, using established architecture frameworks
• Threat modelling (STRIDE) and reusable security patterns
• Architecture review boards, design assurance and sign-off
• Validating designs against security standards and policy

AI security & governance

Getting AI programs that touch sensitive data through security and privacy assurance.

• AI use-case risk assessment and threat modelling
• Privacy and data-flow review
• Access controls and data boundaries for AI datasets
• Data classification, masking and privacy analysis
• AI coding agent governance: autonomy and approval modes, shell credentials, MCP integrations
• AI-assisted security assessment, with human judgement on every call
• Security sign-off

DevSecOps & software supply chain assurance

Control assessments of the platforms that build and run your software.

• CI/CD pipeline controls: GitHub Enterprise Cloud, GitHub Actions and runners, AWS CodeBuild, GitLab
• Dependency and code scanning (e.g. Snyk, SAST/DAST)
• Container and Kubernetes microservices security
• Terraform and infrastructure-as-code review for landing-zone changes

Identity & Zero Trust

Identity is the control plane. We design it around least privilege and separation of duties.

• Zero Trust architecture; Microsoft Entra ID and ID Governance
• OAuth 2.0, OIDC and SAML, including partner and client-credentials flows
• Workload identity and secrets (HashiCorp Vault)
• Privileged access (CyberArk, PIM) and CIAM (Auth0)

Cloud security

Secure foundations for Azure, AWS, GCP and multi-cloud.

• Landing zones, Azure Policy, Microsoft Sentinel and Key Vault
• Security baselines and patterns for PaaS services
• Data platform security (e.g. Databricks, Data Lake)
• Cloud security capability uplift roadmaps

Security operations

Leadership and architecture for detection, response and remediation.

• Security operations leadership
• Incident response and vulnerability management
• SIEM integration and security event requirements
• Penetration test scoping and remediation review

Regulated risk & assurance

Turning obligations into controls, evidence and clear risk decisions.

• APRA CPS 234 and CPS 230, ACSC ISM, Essential Eight, NSW Cyber Security Policy
• IRAP readiness, ISO/IEC 27001 and NIST CSF
• Risk registration and exceptions, and audit evidence
• Third-party and vendor security assessments

Microsoft 365 for 20 to 50 staff

Three packages: Verify, Uplift and Assure. Assess the tenant, close the gaps, then keep the evidence current.