$ modulo --status [ok] fractional ciso ..... security and compliance leadership [ok] ai enablement ....... guardrails · owasp llm top 10 · secure by default [ok] offensive ........... pentest · threat model · code review [ok] compliance .......... soc 2 · iso 27001/42001 · fedramp · pci · hipaa · gdpr principal: matthew marji // toronto, canada
available for engagements

Security that ships
with the product.

Modulo Security builds and runs security programs for engineering-led companies. Fractional CISO leadership, AI enablement with security and cost guardrails, penetration testing, and the compliance work that comes with selling to enterprises.

Most security slows teams down because it arrives as a checkpoint. I build it into how software already gets made, so the secure path is also the fast one.

[01] · where i spend most of my time

when leadership wants to ai all the things

They can. The caveats are security and cost, and most companies only plan for one of them.

Every exec team has already decided it's a priority. Engineering adopts it in weeks. Security shows up much later, once the data flows are built and there has been tool sprawl. Finance shows up around the same time, holding a bill nobody forecast.

The work is making that adoption safe without slowing it down, and without locking into one vendor. No matter what tool, it's important that the guardrails are in place, and I am here to help define and implement them.

None of this is a template. The guardrails get built against how your teams actually work, the tools they actually use, and the architecture you actually have.

// 01

Security guardrails, no matter the tool

Teams pick their own tools, and they change them every few months. The controls sit in your pipeline instead of inside a vendor, so swapping a model does not undo your security.

model swap
$ switch provider → anthropic
pipeline controls unchanged
policy re-applied automatically
swapping a model does not undo your security
// 02

Financial guardrails

AI spend gets away from companies quietly, and the usual reaction is to restrict who gets access. That is the wrong lever. The same standardization that enforces security also caps what gets consumed, so everyone keeps their tools and finance stops getting surprised.

ai spendmonth to date
consumed$18.4k / $25k cap
per-team caps, nobody loses their tools
// 03

One gate for human and agent code

AI writes code faster than anyone reviews it. The checks run where your code already runs, so code from an agent gets the same in-depth security review as code from a person. Same gate, same depth, no separate track for the machine.

pull request checks#4821
security-reviewhuman
security-reviewagent
secrets scanclean
same gate, same depth — no separate track for the machine
// 04

A standard set of security-review skills

One shared set of AI skills any team can pull from, which reviews code for security before it merges. One standard, instead of every team improvising its own.

shared review skills
authz-boundary-checkv3
secrets-in-diffv2
injection-probev1
one standard, not every team improvising
// 05

OWASP Top 10 for LLMs

Prompt injection, insecure output handling, data leakage. Threat modeled against your architecture and your agents, not scored against a generic checklist.

threat model
LLM01 prompt injectionmodeled
LLM02 insecure outputmodeled
LLM06 data leakagemodeled
against your architecture, not a generic checklist
// 06

Secure by default

Engineers should not have to make the secure choice. They should get it by taking the normal path, because the normal path is the one that was built properly.

the normal path
$ create service billing-api
tls, secrets manager, authz scaffold
audit logging wired
secure because it is the default, not a choice
Companies do not need permission to use AI. They need the guardrails that make it defensible, and the ones that keep it affordable.
[02]

what i do

Six things. Most engagements are one or two of them, and they tend to grow into the others.

// 01

Fractional CISO

Senior security leadership for teams that need the strategy, the roadmap, and someone accountable, but not a full-time executive. I own the program, run the vendor and audit relationships, and sit in the rooms where security decisions get made.

  • Board and customer-facing security narrative
  • Roadmap, budget, and hiring plan
  • Risk register that engineering actually reads
risk registerq3
enforce SSO org-wideeng · oct 3
vendor access reviewops · oct 10
prod access tieringclosed
owned and dated — the register engineering actually reads
// 02

AI enablement & security

Your engineers are already using AI. The job is making that safe without banning it, and keeping the bill predictable while you do. I set the guardrails, review how models and agents touch your data, and build the approval paths so teams move fast inside a boundary instead of around it.

  • Tool-agnostic guardrails, enforced in CI/CD
  • OWASP Top 10 for LLMs, threat modeled
  • Financial guardrails on AI consumption

Read how this works ›

guardrail coverage
copilotenforced
cursorenforced
claude codeenforced
controls live in your pipeline, not in a vendor
// 03

Penetration testing

Testing that finds what is genuinely exploitable, then tells you what to fix first. Reports are written for the engineer who has to close the ticket, with a reproduction and a fix, not a scanner dump with severity labels attached.

  • Web app, API, and cloud infrastructure
  • Authentication and authorization depth
  • Retest included once fixes land
findings · web + apiretest incl.
3critical
12high
28medium
ordered by exploitability, not CVSS score
// 04

Security program build

The first-security-hire work, without the hire. I have done this from zero more than once: pick the controls that matter at your stage, get them running, and leave a program your team can operate after I step back.

  • Secure SDLC and paved roads
  • IAM, access review, vendor management
  • Incident response you have actually rehearsed
program · series a
secure sdlc & paved roadsrunning
iam & access reviewrunning
incident responserehearsed
left operable by your team after I step back
// 05

Compliance & certification

Audits turned into real security instead of a screenshot exercise. I have owned exception-free SOC 2 Type 2, PCI SAQ-D, HIPAA, and GDPR, and built the trust portal that answers customer questions before sales has to ask you.

    • SOC 2
    • ISO 27001
    • ISO 42001
    • FedRAMP
    • PCI
    • HIPAA
    • GDPR
    • Readiness, evidence automation, audit management
    • Framework choice: what you need, not everything
    evidence, collected once
    security program
    SOC 2type 2
    ISO 27001certified
    HIPAAattested
    one control set, mapped to every framework
    // 06

    Security automation

    AI agents that do the tedious security work end to end. Vulnerability triage, dependency upgrades, cloud alert validation, and customer questionnaire answers, each with a human only where judgment is required.

    • Autonomous vulnerability triage and fix PRs
    • Bug bounty tier-1 handling
    • Cloud finding validation against live environments
    agent runlast 24h
    findings triaged142
    fix PRs opened18
    escalated to a human4
    a human only where judgment is required
    [03]

    who you are working with

    Matthew Marji. Software engineer by training, over a decade writing code and securing software, and a security leader for the last five years. Most recently the first security hire at WorkOS, the identity platform behind OpenAI and Plaid, where I grew the function from one person to eight. Before that I owned the security engineering roadmap at Narvar, and spent three years on product security at Auth0, through the Okta acquisition.

    Security for me is a collaborative function, built with engineering rather than imposed on it. It is not one size fits all, and what I care about most is meeting an organization where it actually is. AI-native in practice rather than in pitch. I have agents in production today doing real security work.

    I am curious about the businesses I work with, and I treat every engagement as if the company were mine. That means learning how you actually operate before recommending anything, then doing the work that returns the most value at the stage you are at, for the needs in front of you.

    More background at matthewmarji.com.

    [04]

    start a conversation

    $ modulo --contact

    Tell me where things stand and what you want help with.

    No sales pitch. I want a real understanding of your current state first, and then I will be straight about what I can help with. If someone else is better suited to the problem, I will say so and point you to them.