// vCISO + SOC2 readiness · SaaS security
We run vCISO engagements, SOC2 readiness programs, and security assessments for SaaS companies under 200 employees — companies that need a real security program but can’t justify a full-time CISO yet.
Boston-based, serving SaaS companies across North America
Most fit-call requests get three time options within 1 business day.
Northstar works with SaaS companies between 50 and 200 employees that need a real security program. The most common triggers: customers asking for SOC2 Type II, an enterprise deal stalled on a security questionnaire, or an engineering team grown past the point where part-time security attention is enough. Most engagements last 6 to 18 months. Mara Chen leads every one personally.
A part-time security executive embedded in your team. We meet weekly, sit in your senior staff meetings, and run your security roadmap.
A 90-day structured program that takes a SaaS company from no formal compliance posture to SOC2 Type II ready. Includes gap analysis, policy authoring, control implementation, and audit prep.
A 2-3 week targeted assessment that maps your current security posture against industry-standard frameworks. Delivered as a written report with prioritized recommendations.
Live training sessions, phishing simulations, and ongoing micro-training programs. Designed for engineering-heavy teams that need security awareness without "death by checkbox compliance training."
A 90-person Series B fintech was about to lose three enterprise deals because they couldn't pass security questionnaires. Northstar ran an 8-month vCISO engagement, achieved SOC2 Type II in 9 months, and the three stalled deals closed within 6 weeks of the attestation report.
// Northstar Maturity Framework
Five phases. Each one has a defined output, a defined timeframe, and a clear owner.
Two weeks. We learn your business, map your data flows, and identify which security frameworks actually apply to you. Output: a 6-12 page Discovery Document covering scope, baseline maturity, and the recommended program path.
One week. We translate Discovery into a 12-month security roadmap with prioritized work, owners, and budget estimates. Output: a roadmap document and a kickoff working session with your senior team.
8-16 weeks (varies by scope). We implement controls, draft policies, configure tools, and deploy compliance evidence collection. Output: deployed security program with documented controls, policies live, and evidence collection running.
2-4 weeks. Internal tabletops, pen test coordination, and audit prep. Output: a validation report covering control effectiveness and audit-readiness, plus a pre-audit gap-closure plan.
Ongoing. We sit in your senior staff meetings, run quarterly security reviews, and manage incident response readiness. Output: a continuously-operating security program — not a binder on a shelf.
Mara Chen runs every engagement personally. You are not pitched to by Mara and then handed off to a junior consultant.
Half of our principal advisor's career was inside engineering teams. We know what slows down a release, what compliance requirements actually matter, and what's just security theater.
The Northstar Maturity Framework is the same 5-phase model we run every time. It's not a per-client invention. That makes results repeatable and the engagement scope predictable.
[Real founder photo — replace before launch]
Principal Advisor
CISSP-certified principal advisor. 15 years in cybersecurity.
Mara founded Northstar Security Advisors in 2018 after eight years inside SaaS companies — first as a security engineer, then as the founding CISO at a Series C SaaS company that achieved SOC2 Type II under her leadership.
Read Mara’s full bioWe needed a CISO but couldn't justify the headcount yet. Mara joined us 1 day a week, ran our SOC2 readiness program from scratch, and we passed Type II in 9 months. The engagement was a fraction of the cost of a full-time hire and we got real strategic security leadership, not a compliance checklist.
vCISO engagements are typically $8K-$18K per month depending on scope. SOC2 readiness programs are $40K-$75K for a 90-day program. Assessments are $15K-$30K depending on scope. Every engagement is scoped on the fit call before any agreement is signed.
90 days from kickoff to audit-ready, assuming the company has the basics in place (cloud infrastructure, source control, identity management). Companies starting from scratch may need 4-5 months. The fit call is where we figure out which one you are.
Rarely. Our methodology is tuned for SaaS companies under 200 employees. We sometimes work with B2B fintech and B2B healthcare SaaS, but we refer hardware, government, and enterprise (250+ employees) to specialists.
30 minutes. We learn what is driving your security need (a specific deal, an audit requirement, an incident, or general program-building). We tell you whether Northstar is the right fit. If yes, we propose a scope and budget. If no, we refer you to a firm that fits better.
No. Mara Chen leads every engagement personally. The deliverables come from her — not from a team of junior consultants you have never met.
Sometimes. About one in four vCISO engagements end with the company hiring a full-time CISO they recruited (often someone we helped them find). We are not protective of those transitions — that is the right outcome at scale.
We typically transition into a 1-day-per-month retainer for ongoing program operation: quarterly reviews, audit prep for the annual recertification, and incident response readiness. About 70% of our SOC2 clients stay with us for at least a year after Type II.
// Book a 30-minute fit call
Book a 30-minute fit call. Most fit-call requests get three time options within 1 business day.