IT support
Day-to-day help that actually gets done — workstations, Microsoft 365, printers, Wi-Fi, and the quiet failures nobody files a ticket for.
I have spent a lot of years being the person who picks up when something is down. Not a dispatch queue — the work. That includes the 365 tenant that grew by accident, the shared drive nobody owns, and the printer that only fails on payroll day. I keep notes, I close the loop, and you still know who to call the next time.
- Microsoft 365 and Google Workspace setup, cleanup, and ongoing care
- Workstations, identity, and shared drives that staff can actually use
- Networking, Wi-Fi, and VPN sized for a small office — not a campus
- Vendor and contractor access that you can turn off
Cybersecurity assessments
A written look at what you actually run — identity, email, backups, endpoints, and the assumptions that still count as a control.
Most shops I sit with already have some of this: MFA on a few accounts, a firewall they paid for, a backup that has never been restored. An assessment is not a scare deck. It is a walkthrough of what is in place, what is theater, and what is worth doing in the next 30 days versus the next year. You get it in writing, in language a non-technical owner can act on.
- Identity, email, endpoint, and backup review — the four that get hit first
- A prioritized list, not a 200-page dump
- Hardening pass when you want the work done, not just the findings
- Incident help when you already know something is off
Penetration testing
Authorized tests against what you actually expose — web apps, the external perimeter, wireless in the office — with findings you can fix.
I test with written permission and a defined scope. The point is not a trophy screenshot. It is to show you the path a motivated outsider — or a bored insider — would actually take, then sit with you on the fix. External perimeter, web applications, and internal/wireless when we are on-site in Anchorage. Results come with severity, reproduction steps, and a retest when the work is done.
- External and web-application tests with a written rules of engagement
- Internal and wireless testing when a local visit is the right move
- Findings ranked by what an attacker gets, not by scanner volume
- Retest included so you know the hole actually closed
Vulnerability management
Ongoing scan, triage, and patch — so last quarter’s finding does not become this quarter’s incident.
A pentest is a snapshot. Vulnerability management is the habit. I set up scanning against the systems you actually care about, throw out the noise, and give you a short list with owners and dates. Patch what matters. Accept what you mean to accept. Do not let a critical sit because nobody owned the ticket.
- External and internal scanning on a cadence you can keep
- Triage that separates real risk from scanner noise
- Patch and config work, not just another dashboard login
- A simple register: open, accepted, or fixed — with a date
Access security
Who can reach what, and why. MFA, least privilege, vendor logins, and offboarding that happens the same day.
This is the name of the practice, applied. Shared passwords, ‘the intern still has admin,’ a vendor account from 2019 — that is how most small shops get burned. I map identity, tighten MFA, retire god-mode accounts, and put an end date on every outsider login. When someone leaves, we cut access the same day. You keep the map.
- MFA everywhere it matters, including admins and email
- Least privilege that matches how the business actually works
- Vendor, contractor, and former-employee lockout
- A written access map — who, what, and why
Audit & compliance
Help getting through the questionnaire — HIPAA-adjacent, cyber insurance, vendor reviews — without buying a binder you will never open.
I am not a Big Four auditor and I will not pretend otherwise. What I do is get a small team ready for the questions that actually arrive: insurance applications, a hospital’s vendor packet, a bank’s due-diligence form. Policies that match how you work. Evidence you can find. Gaps closed before someone else scores them. If you need a certified assessor, I will say so.
- Cyber-insurance and vendor-security questionnaires
- HIPAA-adjacent controls for clinics and their vendors
- Policies and evidence that match the real environment
- A gap list with owners — not a binder on a shelf
Websites
Planning, standing up, and looking after a small business site — domain, hosting, updates, and the security that usually gets skipped.
A lot of Anchorage shops are still on a site somebody’s nephew built in 2017, on a host nobody can log into. I help plan what the site needs to do, stand it up or take over what you have, and keep it patched. Forms, SSL, backups, the plugin that has not been updated since the last person left. Not an ad agency. A site that loads, can be edited, and is not an open door.
- Planning: pages, hosting, domain, and who will edit it
- Build or takeover — WordPress and similar small-business stacks
- SSL, updates, backups, and form spam that does not land in a black hole
- Ongoing care so the site does not rot the year after launch
