Context
A SaaS company preparing for ISO 27001:2022 had a fresh penetration test report and a list of technical controls to evidence. The findings needed closing before the next customer security reviews.
The problem
- Open pentest findings across the application, infrastructure and email setup.
- Email authentication was incomplete, leaving the domain open to spoofing.
- Third party OAuth integrations had broader access than they needed.
- Controls existed in places but there was no consistent evidence trail for the auditor.
What I did
Pentest remediation. I worked through each finding at the root cause rather than patching symptoms, documented the fix and supported the retest until it closed.
Email security. I set up SPF, DKIM and DMARC and moved DMARC towards enforcement in stages, monitoring reports so legitimate mail kept flowing.
OAuth and identity hardening. I reviewed connected OAuth apps and permissions, removed what was unused and tightened the rest, alongside MFA and least privilege access.
ISO 27001 technical controls. I drove evidence collection and remediation in Vanta, mapping technical controls such as access control, logging, encryption and change management to the Annex A requirements.
The result
- Pentest findings remediated and retested.
- A documented controls baseline the team can show auditors and customers.
Stack
Vanta, ISO 27001:2022, OWASP ZAP, Bandit, SPF, DKIM, DMARC, Entra ID, RBAC, secrets management.