Modulo Security builds and runs security programs for engineering-led companies. Fractional CISO leadership, AI enablement with security and cost guardrails, penetration testing, and the compliance work that comes with selling to enterprises.
Most security slows teams down because it arrives as a checkpoint. I build it into how software already gets made, so the secure path is also the fast one.
They can. The caveats are security and cost, and most companies only plan for one of them.
Every exec team has already decided it's a priority. Engineering adopts it in weeks. Security shows up much later, once the data flows are built and there has been tool sprawl. Finance shows up around the same time, holding a bill nobody forecast.
The work is making that adoption safe without slowing it down, and without locking into one vendor. No matter what tool, it's important that the guardrails are in place, and I am here to help define and implement them.
None of this is a template. The guardrails get built against how your teams actually work, the tools they actually use, and the architecture you actually have.
Teams pick their own tools, and they change them every few months. The controls sit in your pipeline instead of inside a vendor, so swapping a model does not undo your security.
AI spend gets away from companies quietly, and the usual reaction is to restrict who gets access. That is the wrong lever. The same standardization that enforces security also caps what gets consumed, so everyone keeps their tools and finance stops getting surprised.
AI writes code faster than anyone reviews it. The checks run where your code already runs, so code from an agent gets the same in-depth security review as code from a person. Same gate, same depth, no separate track for the machine.
security-reviewhuman
security-reviewagent
secrets scanclean
One shared set of AI skills any team can pull from, which reviews code for security before it merges. One standard, instead of every team improvising its own.
Prompt injection, insecure output handling, data leakage. Threat modeled against your architecture and your agents, not scored against a generic checklist.
LLM01 prompt injectionmodeled
LLM02 insecure outputmodeled
LLM06 data leakagemodeled
Engineers should not have to make the secure choice. They should get it by taking the normal path, because the normal path is the one that was built properly.
Companies do not need permission to use AI. They need the guardrails that make it defensible, and the ones that keep it affordable.
Six things. Most engagements are one or two of them, and they tend to grow into the others.
Senior security leadership for teams that need the strategy, the roadmap, and someone accountable, but not a full-time executive. I own the program, run the vendor and audit relationships, and sit in the rooms where security decisions get made.
enforce SSO org-wideeng · oct 3
vendor access reviewops · oct 10
prod access tieringclosed
Your engineers are already using AI. The job is making that safe without banning it, and keeping the bill predictable while you do. I set the guardrails, review how models and agents touch your data, and build the approval paths so teams move fast inside a boundary instead of around it.
Testing that finds what is genuinely exploitable, then tells you what to fix first. Reports are written for the engineer who has to close the ticket, with a reproduction and a fix, not a scanner dump with severity labels attached.
The first-security-hire work, without the hire. I have done this from zero more than once: pick the controls that matter at your stage, get them running, and leave a program your team can operate after I step back.
secure sdlc & paved roadsrunning
iam & access reviewrunning
incident responserehearsed
Audits turned into real security instead of a screenshot exercise. I have owned exception-free SOC 2 Type 2, PCI SAQ-D, HIPAA, and GDPR, and built the trust portal that answers customer questions before sales has to ask you.
AI agents that do the tedious security work end to end. Vulnerability triage, dependency upgrades, cloud alert validation, and customer questionnaire answers, each with a human only where judgment is required.
Matthew Marji. Software engineer by training, over a decade writing code and securing software, and a security leader for the last five years. Most recently the first security hire at WorkOS, the identity platform behind OpenAI and Plaid, where I grew the function from one person to eight. Before that I owned the security engineering roadmap at Narvar, and spent three years on product security at Auth0, through the Okta acquisition.
Security for me is a collaborative function, built with engineering rather than imposed on it. It is not one size fits all, and what I care about most is meeting an organization where it actually is. AI-native in practice rather than in pitch. I have agents in production today doing real security work.
I am curious about the businesses I work with, and I treat every engagement as if the company were mine. That means learning how you actually operate before recommending anything, then doing the work that returns the most value at the stage you are at, for the needs in front of you.
More background at matthewmarji.com.
No sales pitch. I want a real understanding of your current state first, and then I will be straight about what I can help with. If someone else is better suited to the problem, I will say so and point you to them.