Andres C.

I help SaaS and startup teams get through SOC 2 and HIPAA without turning it into a six-month distraction from actually building product. Most of the work I do falls into one of two buckets. Either a company needs someone to lead the whole thing from scratch: risk assessment, policies, control design, evidence, and then sitting across from the auditor when it counts. Or they already have a program running (usually in Vanta or Drata) and need someone to keep it honest month to month instead of it turning into a fire drill every renewal. I'm CISSP-certified and work as a fractional CISO/Compliance Officer for a handful of companies at a time. Right now that includes a digital banking platform, a healthtech company handling benefits data under HIPAA, and a couple of SaaS platforms in other verticals. Every audit I've led has passed without exceptions, and I tend to get ahead of the timeline rather than scrambling at the end. I'm platform-agnostic: Drata, Vanta, Sprinto, or no platform at all, because the controls matter more than the dashboard. If you're not sure where your program actually stands right now, that's usually the first thing worth figuring out. Top Rated Plus on Upwork. Happy to talk through where you're at.