Most teams have scanning that reports and nothing that blocks, clusters nobody outside the team has ever reviewed, and cloud permissions that grew faster than anyone tracked. This finds all three before a customer questionnaire or an auditor does.

Read-only access across the cloud accounts, repositories and clusters in scope.

Structured review across three layers — cloud posture (identity and access, network exposure, encryption, logging), delivery pipeline (supply chain, scanning, secrets, permissions), and Kubernetes (RBAC, network policy, resource limits, ingress).

Every finding written up with severity, effort, and a specific remediation step.

Readout call to walk your team through it and agree the sequence.

Findings report — Severity-rated, with the reasoning behind each call. Written for engineers and readable by someone who isn't one.

Remediation roadmap — Prioritised and sequenced, with effort estimates so you can plan around it.

Evidence notes — What you can hand to a customer or an auditor who asks.

Readout call — Walk-through, questions, and agreement on what happens next.

Read-only access to the cloud accounts, repositories and clusters in scope

An architecture diagram if one exists — no problem if not

Any compliance framework you're measured against

Handover is always included. You keep the code, the documentation and the runbooks — the point is that your team can operate this without me.

I work across GCP, AWS and Azure, and most of my recent work has been in regulated fintech, so compliance-shaped requirements (SAMA CSF, PCI-DSS, SOC 2, ISO 27001) are familiar rather than an add-on.