Work with me
I take a small number of engagements alongside building my own products. The work below is what I actually do every week — not a menu assembled to look broad.
Regulated SaaS engineering
Systems where a wrong number is a legal problem, not a bug report: tax transmission, double-entry ledgers, audit trails, multi-tenant isolation.
- Multi-tenant schema design with row-level security
- Double-entry ledger and reconciliation logic
- Fixed-point money arithmetic and idempotent posting
- Append-only audit trail with hash chaining
- Regulator integration and acknowledgement handling
Founders building fintech, billing or accounting products who need the compliance layer built correctly the first time.
Project-based, from discovery through production handover.
Cloud security posture review
A structured assessment of an AWS, Azure, GCP or Microsoft 365 estate, delivered as a ranked remediation plan with business impact stated first.
- IAM, storage and network exposure review
- Domain and DNS hygiene assessment
- Ranked remediation plan in plain English
- Compliance-as-code checks you keep and re-run
Small and medium firms with cloud infrastructure and no in-house security function.
Fixed-scope assessment, with optional quarterly re-scan.
Product security review
An adversarial read of an application before it meets a customer's security questionnaire — or an attacker.
- Threat model and trust-boundary map
- Authentication, authorisation and tenancy isolation review
- Dependency and supply-chain assessment
- Prioritised findings with reproduction steps
Teams approaching a first enterprise customer, a funding round, or a certification.
Two to four weeks depending on surface area.
Evidence over assertion
Findings come with reproduction steps. Recommendations come with the trade-off stated. You should be able to challenge anything I hand you.
Money maths is not negotiable
Fixed-point decimal, idempotent posting, append-only audit trails. In financial systems there is no such thing as an acceptable rounding bug.
You keep the tooling
Compliance checks ship as code you own and re-run, not as a PDF that is stale the week after delivery.
Tell me what breaks if this goes wrong.
That single answer usually tells me whether I am the right person for the job — and I will say so either way.