Jeff CadyYou probably need this if…
Most companies don't need a full-time CISO yet. They need someone who's done the job to guide the plan and help answer the hard questions.
A customer sent a security questionnaire
And nobody owns the answers — or the gaps they expose.
An audit or insurance renewal is coming
You need a credible program and evidence, not a last-minute scramble. See insurance readiness →
You run plants or industrial systems
OT/ICS risk looks different from IT risk, and your plan should too.
Your teams are adopting AI fast
You need governance and guardrails before sensitive data walks out the door.
Infrastructure I've worked inside
Whatever your systems run on, I've likely built it, run it, or helped recover it.
Voice & telecom
Engineer on one of the first nationwide consumer VoIP services over the public Internet, and carried VoIP across traditional telecom switches.
Cellular carriers
Network engineer for an early cloud provider running picture sharing for major U.S. wireless carriers.
Data centers & cloud
Data center builds and decommissions across six sites, and cloud and AI compliance infrastructure for a global manufacturer.
Service providers
Took a voice service provider's go-to-market from the usual 6 to 12 months down to 3.
Energy & utilities
Led infrastructure teams at a regional energy utility: up to 22 people in a $25M+ technology portfolio, with change times cut from months to hours.
Healthcare
On the technical team that remediated a major health insurer breach, working alongside the outside incident response firm.
Manufacturing & OT
Security leadership at a global manufacturer, and Industrial Cyber panels on vulnerability programs in ICS/SCADA environments.
K-12 schools
Designed district-wide voice, data and Wi-Fi for a school district, including an early dark-fiber Ethernet ring. It ran for almost 20 years.
Not sure where you stand?
Take the Security Readiness Check: plain-language questions built on CISA's Cybersecurity Performance Goals and the NIST Cybersecurity Framework. You'll get a score, your top five fixes with free government guides, and a PDF to share with leadership.
Too small for a vCISO?
Church offices, nonprofits, HOA boards and businesses with a handful of people: take the Small Office Security Checkup. Twenty plain questions, a score, a fix list and a one-page report. Then build a Small Office Security Playbook for $149, or call me.
Real risk first. Everything else second.
A security program shouldn't be a checklist you bought. It should be built around what could actually hurt your business, and change as your business does.
Assess
Map your environment, your data, and the threats that realistically apply — IT, cloud, OT, and the people in between.
Prioritize
Rank the fixes by risk reduced per dollar and hour spent, and turn them into a roadmap your team can execute.
Adjust
Reassess as conditions change — new customers, new tools, new threats — and report progress in plain language.
It's the same assess-prioritize-adjust discipline I bring to every engagement — applied to your business, not a template.
What I help your team own
I guide; your people own the program. The goal is a team that understands the why behind every control.
vCISO strategy & guidance
Guide your security strategy, policies, and roadmap. Your team owns the program; I help them build it right and keep it on course.
Security program assessment
A clear-eyed look at where you stand today, from a focused baseline to a full NIST CSF assessment, with a prioritized plan for what comes next.
Incident response & readiness
Guidance through a live incident and your next steps to remediate, plus plans, playbooks, and tabletop exercises so you're ready before one hits. Keeping your own record? Try the free Incident Timeline.
OT/ICS security
Practical guidance for protecting industrial and manufacturing environments without stopping production.
AI security governance
Help shaping AI acceptable-use policy, data controls, and risk review. Your team adopts and enforces them.
SOC & tooling review
Advice on getting more from the SIEM, SOAR, EDR, and DLP you already pay for, or choosing the right ones.
Board & executive reporting
Guidance on presenting security risk in business terms leadership can act on.
Customer & audit support
I walk your team through questionnaires and audits and teach the reasoning behind each answer, so you can own it next time.
Ways to work together
Every engagement starts with a free 30-minute conversation.
- Free call. 30 minutes on one question: what's the security risk that worries you most right now? Then whether I'm the right fit.
- Written scope. A short statement of work under one services agreement, with clear scope and pricing and no surprises.
- Kickoff. We start on a date that works for your team, and you always know what's next.
- A named security lead you can call or email any business day
- Security strategy & roadmap guidance
- Policy guidance
- Monthly check-in call
- Everything in Essentials
- Customer questionnaires and vendor reviews handled with you
- Quarterly executive reporting support
- Annual tabletop exercise
- Everything in Standard
- Your security leader in leadership meetings
- Compliance or OT/ICS program guidance
- Board reporting preparation
Scored against a focused set of high-impact IT and OT practices, with gaps ranked and a 90-day action plan. Best for small and mid-sized businesses and manufacturers getting started.
Start with a baselineFull current- and target-state profiles across all six CSF functions, rated risks, and a 12-month roadmap with a leadership readout. Best for regulated, audited, or board-reporting organizations.
Scope a NIST assessmentA senior second opinion for a decision, architecture review, or board presentation. Or pre-buy a 10-hour block for $3,000.
Book advisory timeGuidance through containment, coordination, and your next steps to remediate during a live incident. Business hours, with best-effort support after hours.
Get incident helpSee the kind of documents you'll get: sample playbooks and a sample recovery report, made with a made-up office and family.
Retainers: fixed monthly price, 3-month minimum, billed monthly in advance · Scope set in your statement of work · Live incident response billed separately
Assessments: 50% to start, 50% on delivery · Fee credited, up to one month's retainer, toward a retainer signed within 30 days
On-site visits available · Travel billed at cost with prior approval
I've sat in the chair you're trying to fill.
I'm a CISSP-certified security leader with more than a decade across SOC operations, security architecture, incident response, and OT/ICS environments.
I've also sat on the buying side. As a security manager, I brought in an outside firm to run a NIST risk assessment and get the program back on course, and chose a partner whose bid came in $20,000 under the competition. I know what a good engagement looks like from your chair.
I've led security at the director and manager level, built programs around SIEM, SOAR, EDR, and DLP platforms, and helped shape AI governance policy.
I'm a member of InfraGard, the partnership between the FBI and the private sector dedicated to protecting U.S. critical infrastructure. Membership gives me access to current threat information and a network of security, law enforcement, and industry professionals, which helps me keep my clients' defenses focused on what attackers are actually doing.
I'm also a professional speaker and a charter member of my Toastmasters club, which matters more than it sounds: a security program only works if the board, the plant floor, and the help desk all understand why it exists.
Outside of security, I coach ultrarunners with the same risk-first approach at jcady.org.
Jeff Cady, CISSPFounder & Principal Consultant, JCady LLC
- Based in
- Goodyear, Arizona
- Member
- InfraGard
- Works
- Remotely, with on-site visits available
- Also
- Professional speaker · Toastmasters charter member
Cyber insurance renewal coming up?
Get the questions answered, the gaps closed and a clear summary to your broker before you apply.
A parent or older relative got hacked or scammed?
I also help older adults recover: devices cleaned, accounts secured, and everything explained in plain language, without the shame.
A plan in place before anything happens
For families
Answer plain questions for about 20 minutes and print a large-type guide with your own phone numbers and what to do when something seems wrong. From $39.
See the Family Security Playbook →For businesses and organizations
Credit unions, cities, HOAs, senior centers and employers: give a playbook to each member, resident or employee. Send codes by email or spreadsheet, with your name on every page. From 50 to 1,000 a year, starting at $395.
Playbooks for businesses and organizations →