Jon W.

I'm Jonathan Welzbacher. I'm a fractional CISO who ships code. Fifteen years across IT Audit and Information Security, originally at Deloitte, then on the inside as IT Audit Manager, Director of Information Security GRC, and Information Security Program Manager at companies running on AWS, Azure, and GCP. I hold CISSP, CISA, and CPA. I approach security like an accountant who listens to the owner to understand their risk profile and best deploy their expenses to realize the most benefit for the organization. I provide the following services: ▸ FRACTIONAL CISO / GRC CONSULTING • vCISO retainer — strategy, customer questionnaires, vendor procurement & risk, IR tabletops, MDM/IAM/DLP oversight, monthly KRI dashboard, automation and set up of security ops • SOC 2 & HIPAA Readiness Sprint — 90 days to audit-ready, with policy suite, evidence automation, and auditor handoff • Internal Audit & GRC co-sourcing — SOX ITGC, ServiceNow or other GRC builds & automation, CMMC, HITRUST, ISO 27001, FedRAMP or other NIST frameworks readiness ▸ SECURITY & AUTOMATION ENGINEERING • Cloud Security Baseline Build — CIS-benchmarked AWS, GCP or Azure environments with GuardDuty, Macie, IAM-change alarms, CloudFront/TLS hardening, MDM + DLP rollout • Custom security tooling — CI hooks, Slack Alerting via SNS, GitHub Actions hardening, internal admin dashboards, agent-based scrapers, evidence-collection bots Recent representative outcomes: ✓ Stood up first SOC 2 + AWS hardening for a Series A SaaS in ~90 days (GuardDuty, Macie DLP, IAM-change alarms, MDM, Workspace DLP, IR/DR tabletop). Successfully achieved SOC2 + HIPAA unqualified reports for 6 clients in past 12 months. ✓ Built HIPAA risk assessment in ServiceNow with quantified likelihood/impact across ePHI assets for a Fortune 250 healthcare benefits manager. Procured and managed HITRUST for same org. ✓ Procured and ran a SOC 2 + ISO 27001 certification for a global B2B sourcing SaaS while owning the engineering-aligned IT risk register. DM me "SOC 2" for a free 30-minute readiness call — I'll respond within 24 hours with a scoped fixed-fee proposal.