Charleston, SC · Remote across the US
Security and compliance
for startups.
An extra pair of hands to check the boxes, two days a week for a quarter, so your team can keep building.
I'm Parris Varney. Twenty-plus years building at startups, a year as an application security engineer inside a public company, and SOC 2 and ISO 27001 at my own. Compliance doesn't have to slow the roadmap. It has to be somebody's job.
01 / What's covered
The checklist, owned.
Everything a security program needs at your stage, with one person accountable for all of it.
Security policies
Written for your company rather than copied from a template, and short enough that people actually follow them.
SOC 2 and questionnaires
Readiness, control design, evidence collection, and the security questionnaires that arrive with every enterprise deal.
Pen tests and patching
Scoping and running the test with a trusted partner, then fixing what it finds. An unfixed finding is worse than no test.
Alerting, reporting, and triage
Monitoring that tells you what matters, a response plan, and someone who has done it before when something fires.
Access and secrets
Least privilege, offboarding that actually removes access, and secrets out of the codebase and into a vault.
Hiring, reviews, and team development
Security in the pull request rather than after the incident, and engineers who know what to look for.
02 / When
When it becomes somebody's job.
You're there if
- →An enterprise prospect sent a security questionnaire and the deal is waiting on it
- →An investor, partner, or customer is asking for SOC 2
- →You're in fintech, healthcare, or another market where the regulators are real
- →Engineers are patching on weekends and nobody owns the alerts
- →You've had a scare, and you'd rather not have the incident
Done looks like
- →Policies people follow
- →Evidence that collects itself
- →An alert you trust and a plan for when it fires
- →A questionnaire you can answer in an afternoon
Then I leave. The engagement is three months a year: a quarter to get it right, then an annual pass to keep it that way.
03 / How it works
A quarter, then an annual pass.
Two days a week, in your systems and your pull requests. Nothing is bolted on that your team can't maintain.
- 01
AssessWeeks 1–2
Where you stand against the framework you need, what's actually exposed, and what matters versus what just looks bad on a scan.
- 02
Fix and documentWeeks 3–10
Policies, controls, patching, alerting, and the evidence trail, shipped with your team so they can keep it running without me.
- 03
Hand offWeeks 11–12
Your team owns the controls. I come back once a year for the renewal, the re-test, and whatever changed in between.
04 / Pricing
$1,000 per day.
Prorated for partial days. The standard engagement is two days a week for a quarter, which comes to roughly $26,000. Pen test vendors, scanning tools, and audit fees are separate and quoted up front, so you know the full number before we start.
2 days / week · 13 weeks · $1,000 / day · ≈ $26,000
05 / Where
Charleston, and everywhere else.
Based in Charleston, South Carolina. For companies in the Charleston area, from downtown to Mount Pleasant, Daniel Island, North Charleston, and Summerville, I work in person when it helps. For everyone else, the engagement runs remote over the video platform of your choice.
06 / Background
Security from the builder's side.
Application security at LendingTree
A year on the infosec team after the SnapCap acquisition, reviewing code and shipping fixes across a public company's products.
SOC 2 and ISO 27001 at Source
Stood up the controls at my own company, in the middle of a platform rebuild, without stalling the roadmap.
Fintech and healthcare
BusinessLoans.com, SnapCap, and CoPatient: lending and healthcare billing, where the data is sensitive and the questionnaires are long.
07 / Security and compliance questions
FAQ.
Do you do SOC 2?
Yes: readiness, control design, evidence collection, and working with your auditor through the audit. I don't issue the report; a licensed CPA firm does. I'll help you choose one and get you through it.
Can you fill out our security questionnaire?
Yes, and more usefully, I'll make the answers true. Most questionnaires fail on the same few controls: access reviews, incident response, vendor management, and encryption at rest.
Do you run penetration tests?
I scope them, bring in a trusted testing partner, and own the remediation. The test is the easy part. Fixing the findings and proving they're fixed is the work.
Will this slow the engineers down?
The point is the opposite. Security that lives in the pull request and the deploy pipeline costs a few minutes a day. Security that arrives after an incident costs a quarter.
Is this a fractional CISO?
Close enough. The title matters less than the work: policies, controls, monitoring, and a named person accountable for them. If your customers or auditors need the title on the org chart for the engagement, that works.
Which frameworks do you work with?
SOC 2 and ISO 27001 most often. HIPAA comes up in healthcare. The controls overlap more than the acronyms suggest, so the second framework is far cheaper than the first.
What does it cost?
$1,000 per day, prorated. The standard engagement is two days a week for a quarter, roughly $26,000, plus third-party costs like the pen test and the audit, quoted up front.
What if we've already had a breach?
Get in touch. I'll help you contain it, write it up honestly for the people who need to know, and fix what let it happen.
Do you only work with Charleston companies?
No. Charleston clients get in-person time. Everyone else gets the same engagement over the video platform of their choice.
08 / Get in touch
Send me the questionnaire.
Tell me what you're being asked for and when it's due. I'll reply within a business day with next steps, or an honest referral if I'm not the right fit.
Or write to [email protected].