You’ve been asking for this for years. Meanwhile the backlog grows and everything else is already on fire.
One more fire, and still no headcount to fight it?
That’s where I come in. I run your vulnerability and patch-management policy as a daily practice - SBOMs, human-signed VEX, remediation to your SLAs - and keep the audit-ready evidence current. The control you’ve been fighting for finally holds, without another hire.
See where you stand, close the gap, then keep it closed - evidenced continuously.
Exactly where you’re out of SLA, ranked.
A structured read of current practice against every SLA you’ve committed to in ISO 27001, SOC 2, or a customer contract - the gaps ranked, with the evidence behind each finding.
The control built to last, with evidence that regenerates itself.
A fixed-fee project against a real deadline. I clear the current gap to your SLAs, then build the automation that regenerates your compliance documentation - SBOM, human-signed VEX and policy-SLA evidence - on every release, so “compliant” survives the next build, not just the audit.
The control runs daily - signed off by a human.
Ongoing CVE triage and patch decisions - signed off by a person, not a bot - fed into the automation from step 2, so the documentation stays current and the vulnerabilities that matter actually get handled. The function you’ve been asking for, resourced at last, without another headcount.
Coverage and SLA depth scale to your estate.
Twenty-five years in software engineering, DevOps, SRE, and release engineering at Pivotal, VMware, Shopify, and Mechanical Orchard. I work specifically on the supply-chain side: reproducible builds, SBOM generation, dependency provenance, CVE remediation pipelines. Lately I’ve been exploring where agent-assisted workflows can make the repetitive parts of SBOM analysis, vulnerability triage, and remediation evidence cheaper and faster: the patient, tedious work that usually makes engineers want to quit. Based in Dublin.
Pick a slot for a policy gap review - a short, fixed-fee read of where your real practice stands against the policy you’ve published, and what it would take to close the gap.
Scheduler not loading, or none of the slots work? Email me directly: [email protected]