Security engineering, on demand
Senior security and infrastructure engineers, embedded with your team
Security engineers, cloud and platform engineers, and compliance leads who build and run the programs they are hired to defend. Fractional, dedicated, or as a managed function.
Why Oblak Security
Engineers who ship, not just advise
Hands-on, not advisory
We implement the controls, write the pipelines, and run the on-call. Documentation is the output, not the deliverable.
Senior from day one
No juniors learning on your dime. Every engineer we place has built and operated security programs in production.
Ed-tech and student-data depth
Years of work inside platforms handling records of minors, where FERPA, COPPA, and state student-privacy laws gate every district deal.
Compliance-fluent
SOC 2, FERPA, COPPA, SOPIPA and SOPPA, HIPAA. We know what auditors and procurement teams ask for and build the evidence as we go.
Coverage, not a single point of failure
A managed function means multiple engineers and bench coverage through our vetted network, so your program does not stop when one person is out.
Month-to-month
Scale up, scale down, or switch models as your needs change. Short minimum term, no long-term lock-in.
Roles We Staff
Every security discipline, one provider
Each role is available fractional, dedicated, or as part of a managed function. Starred roles are where our own hands-on depth runs deepest.
vCISO / Security Program Lead
Strategy, risk ownership, board and customer reporting, roadmap, and orchestration of the roles below.
Best for: Founders who need a security leader and a plan, part-time.
Application Security Engineer
SAST and SCA in CI/CD, secure code review, threat modeling, secure SDLC, remediation guidance.
Best for: Product teams shipping fast that need to ship securely.
SOC 2 & Compliance (GRC) Engineer
SOC 2 readiness and audit, FERPA, COPPA and state-law mapping, policies, evidence, vendor risk, security questionnaires.
Best for: Companies blocked in district or enterprise procurement.
Student Data Privacy Engineer
FERPA and COPPA compliance engineering, data-flow mapping, privacy-by-design reviews, DPA support.
Best for: Ed-tech companies handling records of minors.
- Vulnerability Management Engineer
- Continuous scanning, triage, prioritization, patch orchestration, SLAs and reporting. Hands-on remediation, not just inter-team orchestration.
- Teams drowning in scanner noise with no remediation program.
- Cloud Security Engineer
- AWS, GCP and Azure hardening, CSPM, IAM policy, secrets, network security, IaC guardrails.
- Cloud-native teams scaling infrastructure fast.
- Incident Response
- IR plans and runbooks, tabletop exercises, on-call containment, forensics, breach-notification support.
- Any company holding sensitive data.
- Detection & Response Engineer
- SIEM, centralized logging pipelines, alerting, threat detection, monitoring and response.
- Teams with no visibility into what is happening in production.
- DevSecOps Engineer
- Security automation in CI/CD, IaC scanning, container and Kubernetes security, secrets management, guardrails as code.
- Fast-moving engineering orgs that want security built into the pipeline.
- Identity & Access Management Engineer
- SSO and MFA, least privilege, provisioning and deprovisioning, RBAC, access reviews.
- Companies scaling headcount and SaaS sprawl.
- Security Architect
- Architecture and threat modeling, security design reviews, data-flow analysis, roadmap.
- Teams making platform decisions that are costly to reverse.
- Penetration Tester / Offensive Security
- Application and cloud penetration testing, red-team exercises, remediation validation, customer-facing test reports.
- Companies whose customers demand third-party pen tests.
- SRE / DevOps Engineer
- Site reliability, infrastructure automation, observability, and platform engineering.
- Teams scaling infrastructure and improving reliability.
- IT & Endpoint Security Engineer
- Device hardening, MDM, EDR, patching, access baselines, phishing defense, security awareness.
- Companies with laptops and BYOD and no dedicated IT security owner.
Fixed-Scope Packages
Defined deliverables, defined timeline
When you need an outcome more than a headcount. Each package is scoped with you before we start.
SOC 2 Readiness Assessment
Gap analysis against the Trust Services Criteria, a prioritized remediation plan, and an evidence map for your auditor.
AWS Account Hardening
Organizations, IAM, logging, guardrails, and the ten things we fix first in every AWS account.
Student Data Privacy Review
FERPA and COPPA data-flow mapping, consent and retention review, and DPA-ready documentation for ed-tech products.
Incident Response Plan & Tabletop
A written IR plan, role assignments, runbooks for your top scenarios, and a facilitated tabletop exercise.
CI/CD Security Baseline
SAST, SCA, secret scanning, and IaC checks wired into your pipeline with sane thresholds that do not block deploys.
Security Questionnaire & DPA Support
Hands-on help answering enterprise and district security questionnaires and negotiating data processing agreements.
Who We Serve
Regulated technology companies
Ed-tech and K-12 vendors
Platforms handling student records where district procurement demands FERPA, COPPA, and state-law compliance before a contract is signed.
B2B SaaS pursuing SOC 2
Teams that need a SOC 2 report to close enterprise deals and do not want to build a compliance function from scratch.
Seed to Series B startups
Companies with no security hire yet that need a leader, a plan, and someone to do the work.
Healthcare and regulated SMBs
Organizations under HIPAA or NIST expectations that need senior security engineering without an enterprise budget.
How We Work
Three engagement models
All engagements are month-to-month with a short minimum term. Scale up or down as you grow.
Fractional
A senior engineer part-time, for a specific need. Senior expertise without a full-time headcount, scoped to the work in front of you.
Best for: Startups, specific projects, or the first security hire.
Dedicated
A full-time engineer embedded with your team. They attend your standups, use your tools, and operate as a member of your organization.
Best for: Growing teams that need consistent, daily security support.
Managed Function
A blended team running your whole security program. Multiple roles, coverage and redundancy, and we own the outcome end to end.
Best for: Companies that want to outsource the entire security function.
Track Record
Built in production, not in slide decks
Our security practice is led by an engineer who has run programs end to end, from the first AWS account to the enterprise security questionnaire.
- Ran a complete managed security program for three years for a nonprofit K-8 literacy platform, the foundation for a partnership serving millions of students
- Founding engineer and security lead at a venture-backed identity-security startup through acquisition
- Built and operated SAST and SCA pipelines, threat models, centralized logging and detection, and incident response runbooks in production
- Deep AWS expertise: account hardening, IAM design, infrastructure as code, and cloud-native detection
- Completed vendor security questionnaires, district data privacy agreements, and SOC 2 evidence collection at scale
- Experience across FERPA, COPPA, SOPIPA and SOPPA, HIPAA, SOC 2, and NIST CSF
From the Blog
Security writing for operators
What a Managed Security Function Looks Like in Practice
A realistic look at what outsourcing your entire security function means day to day, how we structure managed engagements, and when it makes sense over building in-house.
ReadIntegrating Application Security into CI/CD Without Slowing Down Deploys
A practical guide to adding SAST, SCA, and secret scanning to your CI/CD pipeline with real tool recommendations and strategies for keeping developer velocity high.
ReadCOPPA in 2026: What the New Opt-In Rules Mean for Your Product
A practical breakdown of the April 2026 COPPA rule changes, what verifiable parental consent means for product teams, and how to build compliant consent flows.
ReadFAQ
Common questions
What security roles does Oblak Solutions staff?
We staff 14 security and infrastructure roles: vCISO / Security Program Lead, Application Security Engineer, Vulnerability Management Engineer, Cloud Security Engineer, Incident Response, SOC 2 & Compliance (GRC) Engineer, Detection & Response Engineer, DevSecOps Engineer, Identity & Access Management Engineer, Security Architect, Penetration Tester / Offensive Security, Student Data Privacy Engineer, SRE / DevOps Engineer, IT & Endpoint Security Engineer. Each is available fractional, dedicated, or as part of a managed function.
What is a virtual CISO?
A vCISO provides part-time security leadership. They own your security strategy, risk register, compliance roadmap, and board and customer reporting without the cost of a full-time executive, and they orchestrate the engineers doing the work.
What is the difference between fractional, dedicated, and managed function engagements?
Fractional is a senior engineer part-time on a specific need. Dedicated is a full-time engineer embedded with your team who attends your standups and works in your tools. Managed Function means we assemble a blended team that runs your entire security program end to end, with coverage and redundancy built in.
How is this different from a traditional consultancy?
Traditional consultancies deliver reports and leave. We embed engineers with your team on an ongoing basis. They work in your codebase and your cloud accounts, and they own outcomes.
Can you help with SOC 2?
Yes. Our GRC engineers run SOC 2 readiness, control design, evidence collection, and the audit itself, and our security engineers implement the technical controls rather than just documenting them.
Can you help with FERPA and COPPA compliance?
Yes. We have deep experience with student data privacy regulations including FERPA, COPPA, SOPIPA, SOPPA, and state-level student privacy laws. Our Student Data Privacy Engineers and GRC engineers handle compliance engineering hands-on.
How quickly can you start?
Typically within days. There is no recruiting cycle. Tell us the role and the model you need and we scope and staff it from our vetted network.
Are engagements long-term contracts?
No. Every engagement is month-to-month with a short minimum term. You can scale up, scale down, or end the engagement as your needs change.
Can I start with one role and expand later?
Yes. Most engagements start with a single role and grow as the team sees value. Switching from fractional to dedicated, or adding a managed function, does not require a new contract.
Get Started
Ready to staff your security team?
Tell us about your environment, your compliance deadline, and the gap you need covered.
For Professionals
Join our talent network
Security, cloud, and platform engineers with production experience. Tell us about your background.