Technology assessment · Hermosillo, Mexico
Fifteen years later I'd been promoted five times at the same company, ending as CTO. Along the way: a SOC 2 Type 2 certification led while running the systems being audited, 99.9%+ uptime on ad-serving and publishing platforms, and engineering and operations teams across Mexico, the US and South America.
Today I spend two to three weeks inside a technology operation — yours, or one you're about to buy — and tell you what's actually true.
Most assessment work is done by people who have never carried a pager. They produce findings that are technically correct and practically useless. The difference shows up in the prioritization — which is the part you're actually paying for.
What you're actually buying: architecture, security posture, technical debt with a remediation cost attached, cloud and vendor costs, key-person risk. A red-flag summary written for someone deciding whether to sign.
Gap analysis against the SOC 2 Trust Services Criteria, a prioritized remediation plan, realistic timeline and cost to audit, and guidance on choosing an auditor.
Incident-pattern analysis, SLOs, on-call structure and load, monitoring gaps, change management, backup and recovery — what's actually causing your outages, rather than what everyone assumes is causing them.
Employment structure, city and talent-market selection, compensation benchmarks, hiring and ramp plan, retention. I built an operations centre in Hermosillo from its first hire into a core delivery hub — I know where this goes wrong because I've been there when it did.
Every engagement ends the same way: a written report — an executive summary a CEO will read, findings precise enough for an engineer to act on — a prioritized roadmap with effort and cost against each item, and a working session with your team. Engagements are fixed-fee, and the fee is agreed before any work begins.
Afterwards, some clients take the report and run with it. Some keep me on a monthly advisory retainer. For large implementation programs, I'll introduce you to people who do that work full time — I'd rather refer the rest than do it half-well.
I work remotely from Hermosillo, Mexico, on US business hours, as I have for US companies for fifteen years. Standard vendor invoice — no employer of record, no entity setup. I take a limited number of engagements at a time.
A short call usually clarifies whether an assessment is the right thing, what it would need to cover, and what it would cost. No obligation — and if I'm not the right fit, I'll say so.