Fractional Teammates · Technology & Quality

Security that has an owner, not just a report

A senior cybersecurity specialist from the OlDevs studio joins your standups for a defined part of each week. They own access and secrets, dependency patching, penetration test coordination, incident readiness and the evidence your buyers keep asking for.

Request a quote What it is

A senior specialist, not a junior placement You own the work and the accounts Reply within one business day

Portal

Members

What a cybersecurity specialist is

OlDevs gives security posture a named senior owner without adding a permanent post to your establishment.A cybersecurity specialist from our Vancouver studio works in your organisation for a defined part of each week, ongoing. They review dependencies and cloud configuration, tighten access control and secrets handling, scope and coordinate penetration tests with independent testers, keep incident runbooks current and rehearsed, and assemble the evidence auditors, insurers and enterprise customers ask for. Findings reach your ticket queue as prioritised work with an owner, not as a PDF nobody schedules. You keep every account, key and document, and the studio covers absence and second disciplines.

Key facts

01Group: Technology & Quality
02Engagement: A defined slice of the week, ongoing
03Languages: English and French
04Testing: Penetration tests coordinated with independent testers
05Typical commitment: Half to 1 day a week
06Judged on: Time to patch · Open critical findings · Access review completion

Technology & Quality

What a security week covers

What this teammate takes off your plate

Dependency and configuration review

Standing review of third-party packages, base images and cloud configuration. Known vulnerabilities are triaged by real exposure rather than raw count, and the fixes are raised as tickets in your own backlog.

SCA · patch triage · cloud config · CVE exposure · backlog tickets

Access and secrets management

Who can reach what, and with which key. Role review, a joiner-mover-leaver process, multi-factor coverage, service accounts, and hard-coded credentials moved into a managed secrets store with rotation.

IAM roles · MFA · secrets rotation · offboarding · least privilege

Penetration test coordination

Scoping the test, briefing the independent testers, arranging environments and safe test data, then turning the report into prioritised remediation work and a retest that closes each finding properly.

scoping · tester briefing · remediation plan · retest · findings tracking

Incident response readiness

Runbooks for the incidents you are actually likely to face, named roles, an escalation path, breach notification duties written down, and a tabletop exercise so the plan gets rehearsed before it is needed.

runbooks · on-call roles · escalation · tabletop drills · breach notice

Compliance and evidence

The artefacts buyers, insurers and auditors ask for: policies, an asset and data inventory, access reviews, and a security questionnaire answer library kept current so a sale is not held up for a week.

policies · asset inventory · access reviews · questionnaires · audit evidence

Secure development support

Threat modelling for new features, security review inside pull requests, secure defaults in your pipeline, and short sessions with your developers so the same class of bug stops arriving.

threat modelling · code review · CI checks · secure defaults · coaching

Benefits

What changes once security is somebody's job

Enterprise reviews stop stalling deals

A buyer's security questionnaire stops being an emergency that pulls engineers off the roadmap. It gets answered from the vault, the access reviews and the last penetration test, by a specialist who has sat on both sides of these documents.

A named vulnerability stops meaning guesswork

When a dependency is in the news, someone can already say which of your services pull it in, whether the vulnerable path is reachable from outside, and whether this warrants an emergency patch or next week's sprint.

Near-misses get reported instead of buried

Having a named person to tell changes what staff do about a phishing email they clicked or a key pasted into a chat thread. You hear about it while it is still one mistake rather than a quiet workaround.

You know who holds your data

The outside services processing customer data become a list you can read, with what each would expose if it were breached and who on your team can reach it. New tools get reviewed before they are connected.

Senior judgement arrives before the incident

Most organisations meet this depth of experience only while something is already on fire. Ongoing security work is rarely a full week's job, so here it turns up on a schedule, separating findings worth acting on from scanner noise.

Security knowledge stops living in one head

The vault, the access reviews and the written reasoning behind each accepted risk sit in your systems under your people's names. When someone moves on, the next person reads the estate instead of rediscovering it.

How it works

Starting a security programme

A call about what you must not lose
We go through your systems, the data you hold and the obligations you are under. You get a written summary of what we heard and a quote before anything is scheduled.
Least-privilege access, granted by you
Named accounts on your identity provider with multi-factor authentication, at the smallest permission that works. No shared logins, and no standing administrator rights we do not need.
A ranked risk baseline
In the first weeks the specialist inventories systems, accounts and data, reviews dependencies and configuration, then ranks what is wrong by real exposure and the effort each fix takes.
Security work joins your normal backlog
Findings become tickets with owners in your tracker, sized and scheduled beside feature work, so they get done rather than deferred to a quarter that never quite arrives.
A weekly report a board can read
Each week you see what changed, what is open and what has been accepted, in plain English or French, without a translation layer between security and the people funding it.

Who it's for

Who asks us for this

Security work is continuous, but there is rarely enough of it in one week to justify a permanent post. These are the situations organisations bring us most often.

Software teams selling to enterprise buyers

Procurement wants security questionnaires, a penetration test report and evidence of access control. Nobody on your team owns that work, and signatures are waiting behind it.

Government bodies and associations

You hold personal data, answer to a board or a public mandate, and need documented controls and incident procedures without adding a permanent security post to the establishment.

Franchises and multi-site operators

Dozens of locations, shared logins, constant staff turnover and a patchwork of systems. Someone senior standardises access, retires old accounts and sets rules head office can enforce.

Organisations whose security person has left

The one person who knew where the keys were has gone. Somebody has to pick up patching, access reviews and the questionnaire queue before any of it goes stale.

12+

Years of studio experience since 2014

Half

Typical commitment — Half to 1 day a week

EN/FR

Languages this engagement can be delivered in

FAQ

Straight answers to the awkward questions

Do you run the penetration test yourselves?

We coordinate it, and we usually recommend that an independent tester does the testing. The people who harden a system should not be the only ones attesting to it. Your specialist scopes the engagement, briefs the testers, prepares environments and safe test data, then owns what happens next: triage, fixes, a retest that closes each finding, and the evidence trail your buyer or auditor wants.

Can you promise we will not be breached?

No, and nobody honest will. What this buys you is a smaller attack surface, fewer standing privileges, dependencies that actually get patched, and the ability to notice and respond quickly when something does happen. We will tell you plainly which risks we have reduced, which you have accepted with your eyes open, and which are still there. Guarantees about outcomes belong in marketing, not in a security programme.

Can you get us SOC 2 or ISO 27001 certified?

We can prepare you; the certificate comes from an external auditor or certification body, never from us. Your specialist maps the controls to what you actually do, closes the gaps, writes the policies, and assembles evidence in a form an assessor accepts. We will also tell you when full certification is more than you need, and a completed questionnaire with a recent test report would satisfy the customer asking.

Who holds our keys and credentials while you work?

You do. Your specialist works under named accounts on your identity provider, with multi-factor authentication and the smallest permissions the task needs. Secrets move out of code and into a managed store your administrators control, with rotation. Nothing is kept in an OlDevs vault. When the engagement ends you revoke the access yourself, and we confirm in writing what was removed.

What if there is an incident outside your specialist's days?

The studio answers, and the runbooks are written so that somebody who was not there can follow them. Another senior person can pick up your incident, because the plan, the contacts and the logging all live in your systems. Be clear with us, though: a fractional slice is not a round-the-clock rota, and we will help you arrange a dedicated provider if that is what you need.

What would make you tell us to look elsewhere?

If you are mid-breach you need incident responders today, not a weekly slice. If a regulator has set a deadline that needs somebody present daily until it passes, hire or bring in a specialist firm. If your licence or your contract requires a named in-house security officer, no external arrangement satisfies that. We will tell you which of these applies before you commit to anything.

Still have a question? Ask us when you request a quote

Let’s connect

Let’s talk about the cybersecurity specialist gap.

Tell us what is not getting done and roughly how much of a week it needs. We’ll reply within one business day with who would cover it and a tailored quote — no obligation.