What You Will Actually DoAdvisory and Program Management (primary): Lead framework-based gap assessments (NIST CSF, CIS Controls, SOC 2, and similar) and translate findings into prioritized, executable roadmaps the client can act on with their existing team and budgetServe as a fractional CISO for mid-market and enterprise clients: advise CIOs and IT Directors on security program structure, vendor management, and risk prioritizationDesign and manage ongoing security programs: define reporting cadence, track initiative progress, manage relationships with MSP and MSSP providers on the client's behalf, and keep the business accountable to the roadmapHelp clients communicate security posture and investment decisions to executive stakeholders; ghost-write board presentations, business cases, and risk summaries that non-technical leadership can understand and act onAdjust program direction as business needs evolve, without losing momentum or client confidence. 5 to 8+ years of cybersecurity experience, with a meaningful portion of that in a client-facing advisory, consulting, or fractional roleA technical practitioner background (security engineering, incident response, SOC leadership, or similar) that you have already translated into advisory work; you understand how the technology works but your value is no longer in operating itDemonstrated ability to manage client relationships at the CIO or Director of IT level: setting expectations, delivering difficult findings, and maintaining trust through a full engagement lifecycleExperience designing or managing a security program, not just assessing one; you know what it takes to move an organization from a gap analysis to measurable progressStrong written communication skills; the ability to write a clear, credible board summary or executive business case is a meaningful differentiator for this roleComfort operating in a small firm environment where you will have significant autonomy and limited administrative support.