Skip to content
07 · service

DevSecOps for ISO 27001, pentests and audits.

I close pentest findings, put the technical controls for ISO 27001 in place and collect the evidence your auditor asks for. Security becomes part of the pipeline instead of a scramble before the audit.

Get a quote
the problem

An audit is coming and the evidence is not ready.

  • Open pentest findings

    The report arrived weeks ago and the findings are still sitting in a spreadsheet.

  • Secrets in the wrong places

    API keys live in config files, CI variables and old commits instead of a vault.

  • Weak email security

    SPF, DKIM and DMARC are missing or set to monitor only, so your domain can be spoofed.

  • No evidence trail

    Controls might exist, but nobody can prove it to an auditor or a customer questionnaire.

what I do

What the engagement covers.

  1. 01

    Pentest remediation

    Fix each finding at the root, document it and support the retest until it closes.

  2. 02

    ISO 27001 technical controls

    Access control, logging, encryption, backups and change management mapped to Annex A.

  3. 03

    Secrets management

    Move secrets into Key Vault or Secrets Manager with workload identity and rotation.

  4. 04

    Identity hardening

    MFA everywhere, least privilege RBAC, OAuth app review and removal of stale access.

  5. 05

    Email security

    SPF, DKIM and DMARC moved safely to p=reject without breaking legitimate mail.

  6. 06

    Security in CI/CD

    Dependency, image and IaC scanning plus SAST and DAST checks in the pipeline.

deliverables

What you get at the end

  • Pentest findings fixed, documented and retested
  • ISO 27001 technical controls in place with evidence
  • Secrets moved into a managed vault
  • SPF, DKIM and DMARC enforced
  • Security scanning added to your pipelines
  • A controls summary you can share with auditors and customers
stack

Tools I use

  • Vanta
  • ISO 27001:2022
  • CIS Benchmarks
  • OWASP ZAP
  • Bandit
  • Trivy
  • Azure Key Vault
  • AWS Secrets Manager
  • Entra ID
  • Defender for Cloud
  • DMARC
  • RBAC
faq

Security questions.

Are you an auditor?
No. I implement the technical controls and gather evidence. The certification audit is done by an accredited body.
Do you work with Vanta or Drata?
Yes. I have driven ISO 27001:2022 evidence and remediation in Vanta, and the same approach works with Drata.
How is the price decided?
After a short call I send a written scope and a fixed quote. No hourly surprises, and nothing starts until you have agreed the scope.
Can you run the pentest too?
I focus on remediation and prevention. For an independent test I recommend a specialist firm, then I fix what they find.

proof and reading

related services

Let us get you audit ready.

Share your pentest report or audit date and I will plan the remediation around it.

Get a quote