Cloud security reviews and audits, either by account/resource numbers which has a minimum of $500 for a single account with a reasonable number of resources or by the hour ($500) for which I have a 4 hour minimum. The small biz stuff is a breeze to audit and create reports on so I keep the lower rate available.
I also do insider threat specific IR work which is typically done on retainer and starts at $10k but averages the $15-20k mark per incident. That work is rare but time sensitive. Hours spent can be as little as 5-6 for initial triage but I usually spend about 12 in a single stretch on average with a few hours of debrief for the client. That work is exhaustive and exhausting but is rarely boring.
Yep, I'm always open to new opportunities, but to manage my own sanity and time, I keep my client list short and have a robust set of referrals if I'm already working on an incident. Almost all of the work I take is after hours and weekends as that's where my flexibility is.
I like the idea of working for a consulting firm as needed but it feels like most of those companies only want full-time commitments and I'm rather attached to my current position.
Comments
Cloud security reviews and audits, either by account/resource numbers which has a minimum of $500 for a single account with a reasonable number of resources or by the hour ($500) for which I have a 4 hour minimum. The small biz stuff is a breeze to audit and create reports on so I keep the lower rate available. I also do insider threat specific IR work which is typically done on retainer and starts at $10k but averages the $15-20k mark per incident. That work is rare but time sensitive. Hours spent can be as little as 5-6 for initial triage but I usually spend about 12 in a single stretch on average with a few hours of debrief for the client. That work is exhaustive and exhausting but is rarely boring.
I imagine nearly 100% of your clientele is through networking?
Yep, I'm always open to new opportunities, but to manage my own sanity and time, I keep my client list short and have a robust set of referrals if I'm already working on an incident. Almost all of the work I take is after hours and weekends as that's where my flexibility is.
I like the idea of working for a consulting firm as needed but it feels like most of those companies only want full-time commitments and I'm rather attached to my current position.