Cybersecurity consulting for SaaS and fintech teams

Application security reviews and threat modelling

Most serious incidents in SaaS and fintech start in the application: an admin portal that trusts the browser too much, an API that returns another customer’s records, or a role that can do more than anyone intended. I review web apps, admin and partner portals and APIs from both sides, reading the code and testing the running system with an account for each role.

Every review starts with a threat model: what data the system holds, who uses it, where the trust boundaries are and what an attacker would go after first. That keeps the work focused on the risks that matter to your business rather than a long list of low-value findings.

• Authentication, session handling, MFA and password reset flows
• Authorisation: broken access control, cross-tenant access and privilege escalation between roles
• API security: object-level access checks, input validation, rate limiting and data exposure
• Handling of personal and financial data, including what reaches logs, exports and third parties
• Secrets, dependencies and known vulnerabilities in the code and its packages
• Admin and back-office tools, which are often less protected than the customer-facing product

Cloud security: AWS hardening, logging and encryption

Cloud misconfiguration is one of the most common ways data is exposed, and it rarely shows up in an application review. I assess your AWS accounts against what a careful attacker would look for, then help you fix what matters first.

I do this work hands-on for a high-growth US technology company through Toptal, hardening a multi-account AWS setup with IAM Identity Center, least-privilege permission sets, mandatory MFA and no day-to-day root use, and monitoring with CloudTrail, CloudWatch and AWS Security Hub. For a wider architecture or cost review, see my AWS cloud architecture service.

• Identity: IAM Identity Center, permission sets, MFA, root account use and long-lived access keys
• Logging and detection: CloudTrail, CloudWatch alarms, Security Hub findings and centralised logs
• Data protection: encryption at rest and in transit, S3 bucket exposure and database access
• Network: VPC design, security groups and services exposed to the internet
• Resilience: patching, backups and disaster recovery that has actually been tested

Email and domain security: SPF, DKIM and DMARC setup

If anyone can send email that looks like it came from your domain, phishing your customers and staff is easy. SPF, DKIM and DMARC let receiving mail servers check that a message really came from you, but many domains publish them without enforcing them, or break legitimate email when they try.

I map every service that sends email on your behalf, set up SPF and DKIM correctly for each, and move DMARC from monitoring to enforcement in stages, reading the reports at each step so legitimate mail keeps arriving. I also set up monitoring for lookalike and typosquatted domains, and review anti-phishing controls in your email platform.

• An inventory of every service that sends mail from your domain
• SPF and DKIM set up and checked for each sending service
• DMARC moved from p=none to quarantine or reject in planned stages
• Monitoring for typosquatted and lookalike domains
• Anti-phishing settings and staff reporting routes in your email platform

Endpoint security for distributed teams

Remote and hybrid teams mean company data lives on laptops in homes, cafés and co-working spaces, and sometimes on personal devices. A lost or compromised laptop can undo good application and cloud security, so I include devices in the assessment where they are in scope.

The aim is a baseline your team can actually keep to, not a policy nobody reads: what every device must have, how it is checked, and what happens when a device is lost or someone leaves.

• Full-disk encryption on every device that holds company data
• EDR or antivirus baselines, and who responds to their alerts
• Patching rules for operating systems and browsers
• Clear BYOD rules: what personal devices may access, and how
• Offboarding steps that remove access on the same day

Security assessments for fintech and financial services

Financial services firms carry extra expectations. Through Toptal, I work as a cybersecurity consultant for a US financial services and wealth management firm, carrying out vulnerability assessments, threat modelling and application security reviews of React admin and sponsor portals and financial CRMs that hold investor personal data, plus endpoint, domain and email security.

For US firms, I write assessment reports and remediation roadmaps aligned with the SEC Regulation S-P safeguards rule and FINRA cybersecurity expectations. For UK firms, the same work maps to UK GDPR’s security requirements. These reports help your compliance team and regulators see what was reviewed and what is being fixed; they are not a legal opinion or a certification, and I work alongside your compliance or legal lead.

Earlier, as Senior Backend, AI & Cybersecurity Engineer at Bodytrak, I built encryption, MFA and role-based access into a real-time industrial safety platform handling sensitive worker data. If you need SOC 2 or ISO 27001 readiness specifically, that is a separate service.

Security review, not an accredited penetration test

To be clear about what you are buying: I am not a CREST- or CHECK-accredited penetration tester. What I deliver is a security review and assessment, combining code and configuration review, threat modelling and hands-on testing of your applications and cloud, written up as prioritised findings with fixes.

For many teams that is the right first step, because it finds and fixes the important issues before anyone else does. If a customer, regulator or public-sector contract requires an accredited penetration test, I can work alongside the testing firm you choose, and the two reports sit well side by side.