Fractional Security Leadership
Director-level security leadership for AWS-based organizations at roughly 20 hours per month. A program owner who produces the roadmap, policies, risk register, and board reporting, rather than an advisor who recommends them.
- Commitment
- ~20 hrs / month
- Minimum
- 3 months
- Reporting
- Monthly + quarterly
- Investment
- $9,500 / mo
Built for a specific situation
- Organizations needing security leadership for SOC 2, HIPAA, CMMC, or ISO 27001 without a full-time CISO
- Companies where security sits with a CTO or IT director who is already fully committed
- Teams that bought AWS security tooling but have nobody turning its findings into decisions
- Businesses facing customer security reviews or board questions with no one accountable for the answers
AWS services managed as part of the program
AWS Security Hub
Posture management, findings triage, and standards adherence
Amazon GuardDuty and Inspector
Threat detection and vulnerability management workflow
AWS Config and Control Tower
Guardrails, configuration standards, and drift response
AWS Audit Manager
Continuous compliance evidence for your applicable frameworks
AWS CloudTrail and CloudWatch
Monitoring, alerting, and log retention
AWS Organizations and IAM Identity Center
Account structure, access governance, and third-party risk evidence
How the engagement runs
1 · Scoping call
We agree on your compliance obligations, current state, and the outcomes that matter in the first 90 days.
2 · Onboarding
Read-only access via a scoped IAM role, review of existing documentation, and stakeholder introductions.
3 · First 30 days
Baseline assessment completed, risk register established, and the security roadmap delivered.
4 · Ongoing
Roughly 20 hours per month against the roadmap, with monthly reporting and quarterly executive readouts.
What you receive
- Security program roadmap, maintained and sequenced against compliance obligations and business priorities
- Policy and standards set, authored and kept current as the environment changes
- Risk register with owners, treatment decisions, and status
- Vendor and third-party risk reviews for new and existing suppliers
- Monthly KPI dashboard built from your AWS security telemetry
- Quarterly board or executive readout, prepared and presented
Sample monthly KPI report
The board-facing format your leadership receives each month.
Delivered by
- CISSP with a governance, risk, and compliance specialization
- Active U.S. SECRET clearance
- 18 years leading engineering, product, and security at global communications providers
- Built a complete security and IT program for ~275 employees across four countries after an acquisition
- Hands-on ISO/IEC 27001, ISO/IEC 42001, NIST AI RMF, and CMMC 2.0 implementation experience
- AWS practitioner since 2011 and former AWS Partner Program administrator
A program owner, not advisory hours
Advisory retainers produce recommendations. This engagement produces artifacts: the roadmap, the policies, the register, and the reporting, maintained month over month so security work moves between check-ins rather than waiting for them.
Contact
Every engagement is delivered personally by Brian Govanlu, CISSP.
Readiness and advisory, not certification
Engagements are readiness and advisory services; they do not constitute certification, which must be performed by an accredited body.
Any AWS infrastructure costs you incur remain your responsibility and are separate from the engagement fee.
Professional services are separate from the CMDash auditor and assessor directory. How that directory stays neutral is set out in the Independence Covenant.