Placeholder content. Edit content/pages/services.md. Be careful to only offer what you can actually deliver, and check your employment contract before advertising outside work.

Not every organisation needs a full security team. Many need a few days of senior attention, applied to the right problem. That's what I offer.

Detection review

An audit of your existing alerting: what fires, what nobody acts on, and where your coverage has holes when mapped against MITRE ATT&CK. Delivered as a prioritised remediation list.

Incident response support

Hands-on help during an active incident, or retrospective analysis and reporting after one. Includes an executive summary written for the people who have to make decisions.

Logging and telemetry uplift

Working out what you should be collecting, what you're paying to collect and never look at, and how to close the gap between the two.

Tabletop exercises

A facilitated scenario walked through with your team, producing a clear list of what worked, what didn't, and who owns each fix.

How it works

  1. A short call. Fifteen minutes to understand the problem and decide whether I'm the right person for it. No charge.
  2. A written proposal. Scope, deliverables, timeline and a fixed price, so there are no surprises.
  3. The work. Delivered against the agreed scope, with progress visible as it goes rather than a document that lands at the end.
  4. A handover. Findings, recommendations and enough context that your team can carry it forward without me.

Ways of working

  • Remote by default, on-site in the UK where a scenario genuinely needs it.
  • Fixed-price for defined scopes; day rate for open-ended support.
  • Happy to work under your NDA.

What I don't do

Being clear about this saves everyone time. I don't offer penetration testing, red teaming, or compliance certification audits. If that's what you need, I'm glad to point you towards people who do it well.


Ready to talk? Get in touch with a couple of lines about what you're facing and I'll come back to you within two working days.