Security leadership at your table,
for the hours you need.
A senior security leader who owns your policy framework, compliance programme, board reporting and roadmap, on an annual contract at four, eight or twenty hours a week, with Mjolnir's full team behind them.
A CISO who stays, not a consultant who leaves a report.
Your vCISO joins your leadership team. They attend the meetings, present to the board, manage your security vendors and own the roadmap. They bring the perspective of having built programmes across many organizations and sectors, which is often more breadth than a single full-time hire can offer.
Behind them sits the rest of Mjolnir: our SOC, incident response, forensics, offensive security and GRC teams. When something goes wrong, your vCISO leads the response with our responders on the line, and when the roadmap calls for a test, an assessment or audit support, the people who do it are already part of the team.
- A security strategy and multi-year roadmap tied to your risk, sector and regulators
- A policy and standards framework: acceptable use, incident response, data classification, access control
- Compliance programme ownership across SOC 2, ISO 27001, PCI DSS, PIPEDA, PHIPA and sector rules
- Quarterly board and executive reporting that puts technical risk in business terms
- Risk management with a live risk register, KPIs and KRIs that track maturity
- Incident leadership: coordinating responders, counsel, insurers and regulators when it counts
How an engagement runs.
Pick the shape
Four, eight or twenty hours a week on an annual contract, matched to where your programme is today.
Baseline
Your vCISO starts with a gap assessment or reviews the one you have, so the roadmap starts from evidence.
Build and run
Policies, compliance, vendor management and reporting run on a steady rhythm, with the roadmap delivered in phases.
Report
Quarterly board briefings and risk dashboards show leadership what changed and what is next.
Three shapes, one annual contract.
Advisory
For mature programmes that need periodic executive guidance, board reporting and a senior voice on major decisions.
Strategic
For building or maturing a programme: policies, compliance, vendor oversight and a roadmap delivered quarter by quarter.
Dedicated
Near full-time leadership for organizations with heavy regulatory load, a certification push or a transformation under way.
Ahead of what is coming.
- Bill C-8 (CCSPA) for critical infrastructure operators, before it comes into force
- OSFI B-13 for federally regulated financial institutions
- Quebec's Law 25 and PIPEDA privacy obligations
- PHIPA for Ontario health information custodians
- Cyber insurer control expectations at renewal
- Tool rationalization, so spend goes where risk is
Who it is for
Organizations with nobody in the CISO role, or an IT manager carrying security on top of the day job. Also boards and regulated firms that need a named, accountable security leader without waiting months for a hire.
- Gap assessment, the baseline your vCISO builds from
- Fandral staff augmentation, analysts to deliver the roadmap
- GRC & compliance, Forseti, controls, evidence and audit support
- IR retainer, responders on contract before you need them
What buyers ask.
Our IT manager covers security.
Then security competes with the helpdesk and loses. A vCISO gives your IT manager a specialist to lean on and gives the board a named owner for risk.
Why not just hire a full-time CISO?
You may, in time. A vCISO gives you senior leadership now, builds the programme a future hire will inherit, and can help you recruit them. Many clients start with a vCISO and grow into a dedicated role.
Will we get a different person every month?
No. You get one named vCISO who learns your business, backed by our wider team for specialist work.
What happens if we have an incident?
Your vCISO leads it. Our incident response team is available 24/7 with a 15-minute average response, so leadership and responders arrive together.
Get the security leader your board is asking for.
Talk to us about which engagement shape fits your organization and risk profile. We will scope it with you, no charge.