// SECURITY LEADERSHIP, ADVISORY, AND STRATEGY · HANS STUDY · ONTARIO, CANADA
Security Leadership, Advisory, and Strategy
Most organizations don't need a full-time CISO. They need senior security judgement they can reach when a decision matters, a strategy that fits their risk and their budget, and one person who's accountable for seeing it through. That's the work. Independent, with nothing to sell you but the advice.
I act as a fractional CISO, security advisor, and strategist for regulated and operationally complex organizations: defence suppliers, critical infrastructure, public safety, and the operators who serve them. Strategy and governance, risk and compliance, framework alignment, vendor and third-party risk, and the board-level translation that turns a technical problem into a decision your leadership can actually make. The kind of leadership that usually means a quarter-million-dollar hire, sized instead to a few days a month.
I work remotely, which means location isn't a constraint. Most of this is done over a call and a shared screen, with on-site time when an assessment or a build calls for it. I'm based in Ontario and take engagements across Canada and the United States.
2 things set this apart from a conventional advisor. The first is defence supply chain compliance. I was doing NIST 800-171 and CMMC readiness in 2019 and 2020, and Canada's new CPCSC runs on the same technical baseline, so it's familiar ground rather than a framework I'm reading up on. The second is the boundary where operational technology, IT, and physical security meet. That's where a lot of real exposure hides, and it's rarely where a pure-IT advisor thinks to look.
Design
Specify it properly, before anyone quotes it.
Security network design →
The network under the cameras and doors. Segmentation, multicast, PoE budgets, redundancy.
Video surveillance design →
Purpose per view, pixel density, storage and retention sizing, recorder architecture.
Access control design →
Door schedules, hardware selection, panel layout, power calculations, egress and code.
High security design →
Borders, detention, defence, utilities and transit. Where failure has real consequences.
Wireless design and validation →
Predictive design and measured validation surveys. Ekahau ECSE Design and CWNA.
Data centre and structured cabling →
Racks, power, pathways, containment and the labelling standards nobody keeps.
Check
Independent review of somebody else’s work.
Pre-purchase design review →
You have a quote and no way to judge it. What is oversized, what is missing, what returns as a change order.
Security assessments and reviews →
Programme and gap assessments, architecture review, network hardening, project oversight.
Platform health checks →
Fixed-price platform review from a $500 remote starter. Genetec, C-CURE 9000, Milestone, Avigilon and AXIS Camera Station.
CMMC and CPCSC readiness →
Scoping, gap assessment and attestation support for defence supply chain.
Advise
Standing on the buyer’s side of the table.
RFP development and bid evaluation →
Writing the specification and scoring the bids. Never written by anyone who could bid on it.
Owner's technical representative →
Somebody technical on your side for the life of a build. Submittals, progress claims, acceptance.
Security design standards →
Your own standard, so every future project and every future integrator inherits it.
Fractional CISO and vCISO →
Senior security leadership on a recurring basis, sized to your stage and budget.
Security and technology strategy →
A roadmap, an architecture direction, and a risk-based plan your board can act on.
OT/IT convergence security →
The physical, OT and IT boundary, read by someone who works on both sides of it.
Investigate
When it has already gone wrong.
Expert opinion and failure investigation →
Written technical opinion for disputes and insurers, and root cause on systems that failed.
Independent throughout. No commissions, no product margin, no financial stake in what gets specified, and no installation work, so a recommendation is a recommendation rather than a quote in disguise. The independence policy sets out exactly what that covers and what it costs.
A straight read on where you stand
Start with a 30-minute scoping call or email contact@hans.study. You'll get a straight read on where you stand and an honest answer on whether I'm the right fit.
Related work: fractional CISO work that took a startup to ISO 27001 readiness.