Lukas Mindaugas C.

I get SaaS companies ready for SOC 2, ISO 27001 and HIPAA, and I do the technical fixes myself, not only the paperwork. Most compliance projects stall between two kinds of people: consultants who write policies but cannot touch AWS, GitHub or Google Workspace, and engineers who can fix the settings but will not write the policies or talk to an auditor. I do both, so findings get closed instead of listed. WHAT A TYPICAL ENGAGEMENT LOOKS LIKE - Gap assessment against the SOC 2 Trust Services Criteria or ISO 27001 Annex A, with a ranked list of what an auditor will flag. - Technical remediation: former employees still holding access, MFA gaps, backups never restore-tested, code merged without review, logging off in cloud regions, secrets in repositories. - Policies written to match how your team actually works, not a template nobody follows. - An evidence folder organised by control, collected by script so it stays current. The toolkit I use is open source; it is in the portfolio below. - Buyer security questionnaires answered, with a reusable answer library. - Fractional CISO support after you pass: access reviews, vendor reviews, new questionnaires. SECURITY AUDITS FOR SAAS AND AI-BUILT APPS Applications I know from the inside: Supabase row-level security proven by attempt rather than by reading, cross-tenant and IDOR testing, authentication and session handling, webhook verification, secrets reaching the client bundle, and the specific ways AI-assisted codebases fail. Written authorization first, scope in writing, and no finding I cannot reproduce. RECENT WORK - SOC 2 readiness for a 22-person SaaS: 180-question buyer questionnaire answered in four days, 14 policies, evidence folder, deal signed, Type I three months later. - Penetration test of a 340-company multi-tenant SaaS: 13 findings, two critical (cross-tenant data access, privilege escalation), both closed in five days, retest passed. - AWS incident response: root cause in 8 hours, clean rebuild in 48 with zero downtime, detection fixed so the next alert fires in minutes. - Email and identity hardening for a 60-person law firm: DMARC to reject, MFA enforced, phishing click-through from 19% to 4%. WHY THE ENGINEERING MATTERS I also build production systems: multi-tenant platforms with row-level security on every table, Stripe billing, audit logs, AI voice and chat agents. Most of what I find in an audit is something a developer forgot under deadline. I have been that developer, which is why my remediation ships as code and configuration, not recommendations. Facing an audit, a buyer questionnaire or a launch? Describe where you are in two sentences and I will tell you honestly what it takes and what it costs.