Mara Chen runs your security program one day a week: policies, audit preparation, and the questionnaires your sales team is waiting on. For companies with 50 to 200 employees.
You get three call times by email within one business day.
SaaS companies with 50 to 200 employees, usually Series A to C, with production on AWS, Google Cloud or Azure and no one on staff whose job is security. Most engagements last 6 to 18 months.
Mara joins your leadership meeting every week, owns the security roadmap, and answers customer security questions for you.
A 90-day program that takes you from no formal compliance work to ready for a SOC 2 Type II audit window.
A 2 to 3 week review of your security against NIST CSF, CIS Controls or SOC 2, delivered as a written report with a ranked list of fixes.
Live onboarding sessions, quarterly phishing tests and short monthly scenarios, written for engineering-heavy teams.
The same opening for every vCISO and SOC 2 client. By day 30 you have two documents and a weekly rhythm.
Day 1
Kickoff with your CTO and one engineering lead. We agree on scope and who owns what.
Days 2 to 10
Mara reads your existing docs, maps where customer data lives, and interviews 3 to 5 people.
Day 14
You receive the Discovery Document: scope, current state, and the gaps that matter for your audit.
Day 21
You receive a 12-month roadmap with owners, dates and a tooling budget.
Day 30
Weekly cadence starts: one standing meeting, policy drafts in review, compliance platform connected.
Every engagement runs through the same five phases. Each phase ends with a document you keep.
| Phase | Length | What happens | What you keep |
|---|---|---|---|
| 1Discovery | 2 weeks | Data-flow map, frameworks in scope, and where your program stands today. | Discovery Document, 6 to 12 pages |
| 2Roadmap | 1 week | Prioritized work with owners and a budget, reviewed with your leadership team. | 12-month roadmap |
| 3Build | 8 to 16 weeks | Policies written, controls configured, and your compliance platform collecting evidence. | Policies, controls and evidence collection in place |
| 4Validate | 2 to 4 weeks | Tabletop exercise, penetration test coordination, and a mock audit. | Readiness report and gap-closure plan |
| 5Operate | Ongoing | Weekly leadership meeting, questionnaire answers, and incident response readiness. | Quarterly security review |
1Discovery 2 weeks
Data-flow map, frameworks in scope, and where your program stands today.
You keep: Discovery Document, 6 to 12 pages
2Roadmap 1 week
Prioritized work with owners and a budget, reviewed with your leadership team.
You keep: 12-month roadmap
3Build 8 to 16 weeks
Policies written, controls configured, and your compliance platform collecting evidence.
You keep: Policies, controls and evidence collection in place
4Validate 2 to 4 weeks
Tabletop exercise, penetration test coordination, and a mock audit.
You keep: Readiness report and gap-closure plan
5Operate Ongoing
Weekly leadership meeting, questionnaire answers, and incident response readiness.
You keep: Quarterly security review
Ledgerline had three enterprise contracts waiting on a SOC 2 report. Mara joined one day a week, ran the readiness program, and the report came back clean nine months after kickoff. All three contracts were signed within six weeks of it.
Read the Ledgerline case study“Mara sat in our Tuesday leadership meeting for eight months. By the time the auditor arrived, our engineers were answering the control questions themselves.”
Anything else goes on the fit call, or email [email protected].
A vCISO engagement is $8,000 to $18,000 a month depending on scope. A SOC 2 readiness program is $40,000 to $75,000 for 90 days. An assessment is $15,000 to $30,000. You get a written scope and a fixed price after the fit call, before anything is signed.
90 days from kickoff to audit-ready if you already have cloud infrastructure, source control and single sign-on in place. Starting from scratch takes 4 to 5 months. The audit window itself adds 3 to 12 months for Type II, set by you and your auditor.
Northstar works with SaaS companies under 200 employees, including B2B fintech. Hardware, government contractors and companies over 250 people get a referral to a firm that specializes in them.
It takes 30 minutes. Mara asks what is driving the work, such as a deal, an audit date, an incident or a board request. If Northstar fits, you get a written scope and price within three business days. If it does not, she names a firm that does.
Mara Chen, on every engagement. Northstar does not subcontract. Penetration tests are run by an outside firm you contract directly, and Mara coordinates them.
Yes. When a client is ready, Mara helps write the job description, sits in on interviews, and hands over the program. The engagement has a 30-day exit clause for this.
Most clients move to a one-day-a-month retainer covering quarterly reviews, preparation for the annual audit, and incident response readiness.
Tell her what is driving the work. If Northstar fits, you get a written scope and price within three business days.
Demo only. A client site ships one look.