Services

One engagement, four questions.

Every engagement is the same shape: two to three weeks inside your technology operation, ending in a written report, a prioritized roadmap with effort and cost against each item, and a working session with your team. Fixed fee, agreed before any work begins. What changes is the question I'm answering.

Technical due diligence

For acquirers and investors — "what are we actually buying?"

Before you sign, someone who has run production systems should look at what you're purchasing. I assess:

Architecture — and whether it scales past the growth in the deck
Security posture and compliance exposure
Technical debt, with a remediation cost attached rather than an adjective
Cloud and vendor cost structure — what the margin really looks like
Team composition and key-person risk
Open-source licensing exposure and IP ownership
Vendor lock-in, backup, and disaster recovery

The deliverable is a red-flag summary with dollar estimates, written for someone deciding whether to sign — not a hundred-page appendix nobody reads.

Compliance readiness

For companies with enterprise deals stuck in a security questionnaire

Most companies buy a compliance platform first and discover it tracks the work rather than doing it. Policies still need writing, controls still need building, and someone still has to talk to the auditor. I tell you what the work actually is:

Gap analysis against the SOC 2 Trust Services Criteria in scope
A remediation plan that distinguishes what blocks the audit from what an auditor would merely prefer
A realistic timeline and cost to audit
Auditor selection — what to ask, what it costs, who fits your size

I led a SOC 2 Type 2 certification end to end while running the infrastructure being audited. The controls I recommend are ones your engineers will actually operate, because I've had to operate them myself.

Reliability and operations

For companies whose uptime is costing them customers

When things keep breaking, the cause is usually not what everyone assumes it is. I look at the evidence:

Incident-pattern analysis — what actually causes your outages
SLO and SLI definition, or the absence of it
On-call structure and the load it puts on your team
Runbook coverage, monitoring and observability gaps
Change management, capacity, backup and recovery

I spent years in the NOC before I ran one, and years running one before I ran the company's technology. This is the work I know best.

Nearshore engineering

For US companies building — or struggling with — a team in Mexico

US companies constantly want engineering in Mexico and have little idea how. Two ways I'm brought in: "we want to build this — how?" and "we built this and it isn't working — why?" Either way, the ground covered is the same:

Employment structure — own entity, employer of record, or contractors, with the real cost implications of each
City and talent-market selection — Hermosillo, Guadalajara, Monterrey, CDMX are different markets with different economics
Compensation benchmarks and retention
Hiring pipeline and a realistic ramp plan
The distributed-management practices that make it work across time zones

I built an operations centre in Hermosillo from its first hire into a core delivery hub, and served as VP Operations for a Mexican entity. I know where this goes wrong because I've been there when it did.

Afterwards

Some clients take the report and run with it. Some keep me on a monthly advisory retainer — ongoing architecture and security review, customer security questionnaires, vendor assessments. For large multi-month implementation programs, I'll introduce you to people who do that work full time. Assessment and prioritization is what I do; I'd rather refer the rest than do it half-well.

Fees are fixed per engagement and agreed on the first call, before any work begins. I take a limited number of engagements at a time.

Get in touch