Security & Compliance
Pass the audit because the controls are real.
Security that gets bolted on before an audit is expensive and rarely survives contact with production. Security designed into the identity model and the network boundary tends to hold.
The problem
Security work often arrives as a spreadsheet of controls two weeks before an audit. By then the choices that mattered — identity model, network boundaries, secret handling — were made a year earlier and are expensive to reverse.
What we deliver
- Cloud security architecture: identity, least-privilege IAM, network segmentation
- SOC 2 readiness — control design, implementation, and the evidence trail
- Secrets management and rotation with AWS Secrets Manager or equivalent
- WAF, DDoS protection and edge security configuration
- Security review of existing estates, with findings ranked by real exploitability
- compliance experience in production environments
- SOC 2
- in production systems
- 20 yrs
Numbers shown are from the founder’s prior roles, not SevenM engagements.
Technologies
- AWS IAM
- AWS Secrets Manager
- AWS WAF & Shield
- Cloudflare
- Vault
- FreeIPA
Questions
- Can you get us SOC 2 certified?
- We get you audit-ready — designing and implementing the technical controls and producing the evidence. The certificate itself is issued by an independent auditor, and anyone claiming they can grant it directly is misrepresenting how SOC 2 works.
- Do you do penetration testing?
- No, and we do not intend to. Penetration testing belongs with specialist firms rather than with whoever built the architecture — keeping the builder and the tester separate is better practice, and most auditors expect it. We will happily work with a firm you choose, or point you at ones we rate.
- How disruptive is a security review?
- The review itself is read-only and does not touch running systems. Remediation is scheduled with you and phased by risk, so nothing changes without a plan.