Sahil Dubey
Fractional CISO · vCISO · Retainer

Fractional CISO (vCISO) — pass audits and security questionnaires without a full-time hire.

On-demand security leadership for startups and scale-ups: SOC 2, ISO 27001, PCI DSS and HIPAA readiness, security-questionnaire support, and audit sign-off — on a monthly retainer. Led by a CISA + CISM holder who also architects the AWS controls behind the policies.

Book a free 30-min callEmail me

What you get

What a fractional CISO does

  • Own your security program without a full-time C-level cost
  • Set risk-based priorities, policies and a compliance roadmap
  • Represent security to your board, customers and auditors

Frameworks & audits

  • SOC 2 Type 1/2, ISO 27001, PCI DSS, HIPAA, GDPR
  • Gap assessment, evidence automation, control implementation
  • Auditor liaison through to a clean report

Security questionnaires & deals

  • Answer customer/investor security questionnaires fast
  • Build a trust page + reusable answer library
  • Unblock enterprise deals stalled on security review

Technical, not just paper

  • Controls implemented in AWS (IAM, KMS, CloudTrail, Config), not just policy docs
  • Vendor & risk management, incident response, awareness training
  • CISA + AWS Pro: the rare mix of governance and hands-on engineering

Proof

0findings — SOC 2 Type 2 & PCI DSS engagements
8-14 wktypical time to audit-ready
Retainerfractional, scales with you
Fractional CISOvCISOSOC 2ISO 27001PCI DSSHIPAASecurity questionnairesRisk assessmentAWS controlsCISACISM

FAQ

What is a fractional CISO / vCISO?

A senior security leader engaged part-time (fractional) or virtually (vCISO) to run your security and compliance program on a retainer — the expertise of a CISO without the full-time salary.

When do I need one?

When customers or investors send security questionnaires, when you're pursuing SOC 2/ISO 27001, or when security decisions are piling up with no one senior to own them.

How does pricing work?

A monthly retainer scaled to scope and stage — typically far less than a full-time CISO, with the ability to dial up around audits and dial down after.

How is this different from a compliance consultant?

A consultant delivers a project; a fractional CISO owns the ongoing program, represents you to auditors and customers, and makes risk decisions — with the technical depth to implement controls in AWS, not just write policy.

Get CISO-level security without the full-time hire.

Free 30-minute call — tell me your stage, frameworks and any deals stuck on security review.

Book a callAll AWS DevOps services →