Services

Seven ways to work together. Two ways to pay.

Everything below is either a block of prepaid hours or a package with a fixed scope, timeline and fee. Most founders start with a ten-hour block or the one-week review, and decide from there. Nothing here is a retainer.

Hours

For any founder who needs senior judgment without a fixed scope.

Prepaid blocks of ten or forty hours, billed in fifteen-minute increments, that you use when you need them: an architecture decision that will be expensive to reverse, a vendor contract you are about to sign, a board or investor update on technology, an incident you want a second opinion on, coaching for the engineer you just promoted. Unused hours roll forward for ninety days.

What you get

A shared log of every hour and what it produced
Same-week response
Written notes after every working session

Typical length

Ongoing

Pricing is fixed and agreed before we start; I will give it to you on the call.

Technology & Security Review

For founders who want to know where they stand before a raise, a big customer or a big hire.

One or two weeks, depending on the size of the team, looking at the architecture, the codebase (including code written with AI tools), the security basics, the cloud bill, and how work actually gets from an idea to production. You get a written report a non-technical founder can read, a ninety-day plan, and a readout where you can ask anything.

What you get

Written findings ranked by risk and cost
A ninety-day plan with owners
A one-hour readout; the report is yours to share with investors

Typical length

One week for teams up to five engineers, two weeks up to twenty-five

Pricing is fixed and agreed before we start; I will give it to you on the call.

Security Foundations

For companies facing their first customer security questionnaire.

Before SOC 2, there is a shorter list that most questionnaires actually ask about: multi-factor authentication and access control, backups you have tested, secrets kept out of the code, a list of the vendors that touch customer data, a plan for the day something goes wrong, and a handful of written policies. Three weeks to put it in place and to answer the questionnaire in front of you.

What you get

The controls implemented with your team
The core policy set
A completed answer to the customer's questionnaire
A vendor and data inventory

Typical length

Three weeks

Pricing is fixed and agreed before we start; I will give it to you on the call.

SOC 2 Sprint

For companies whose next enterprise deal depends on a SOC 2 report.

I have taken a company from nothing to a SOC 2 Type 2 report in under eight months. The sprint covers scoping, policies, control owners, choosing the compliance platform and the auditor, and setting up the evidence routine so the audit is boring. It ends with an internal owner who can run it without me. ISO 27001 follows the same shape.

What you get

Scope and gap analysis
Policies and control assignments
Platform and auditor selected and onboarded
Evidence collection running; a named internal owner trained

Typical length

Eight to twelve weeks to audit-ready

Pricing is fixed and agreed before we start; I will give it to you on the call.

First Engineering Leader

For founders hiring a head of engineering or VP of Engineering for the first time.

I have hired engineering leaders for over a decade and seen what the expensive mistakes have in common. We define the role around what your company needs in the next eighteen months, not a generic job description. I run the search with you, build the interview loop and scorecards so every candidate is measured the same way, sit in the final interviews, help you close, and write the ninety-day onboarding plan.

What you get

Role definition and compensation range
Sourcing plan and screening
Interview loop, scorecards and calibrated interviewers
Offer and close support; a ninety-day plan for the hire

Typical length

Six to ten weeks

Pricing is fixed and agreed before we start; I will give it to you on the call.

Build Partner Oversight

For founders whose product is being built by an agency or an offshore team.

You should not have to take your development partner's word for it. I review the scope and the contract, sign off on the architecture before it is expensive to change, join the weekly delivery meeting on your side of the table, and check what is delivered against what was promised. When the time comes, I help you bring the product in-house.

What you get

Contract and scope review; architecture sign-off
Weekly delivery review and written status in plain English
Acceptance testing
An in-housing plan

Typical length

Monthly, from a ten-hour block

Pricing is fixed and agreed before we start; I will give it to you on the call.

Technical Due Diligence

For investors and acquirers.

A one- to two-week review of a target's codebase, architecture, security, team and delivery risk, with a written report that separates what is a problem from what merely looks like one, and a hundred-day plan for after the deal.

What you get

A written diligence report
A risk register with cost to remediate
A hundred-day plan

Typical length

One to two weeks

Pricing is fixed and agreed before we start; I will give it to you on the call.

Questions founders ask

We only have three engineers. Is that too small?

No. Most of the founders I talk to have between one and ten. The one-week review and the hour blocks are sized for exactly that.

Do you write code?

I read a great deal of it and I will write when it is the fastest way to show something. I am not a substitute for your engineers, and I will tell you when you need one.

Can we start with ten hours?

Yes. That is how most engagements start.

Remote or on-site?

Both. I am in Maryland and work in person with founders from Washington to Boston; everything else is remote.

What if we already have a head of engineering?

Then I usually work alongside them rather than above them, on the things they have not done before: a first audit, a first big hire, a first board deck.

Will you take equity?

Sometimes, alongside cash, never instead of it.

How do I know this is working?

Every package has a written deliverable, every hour is logged with what it produced, and every engagement ends with a handoff. If you cannot see the result, I have not done the job.