A sitting CISO, not a checklist vCISO.
Dr. Wertheim currently holds CISO roles at an NYDFS-regulated insurtech and an identity-governance software company. Your program gets the same playbook he runs under examination: risk assessment, Part 500 controls, board reporting, incident readiness, and the AI questions your directors are about to ask.
Pick the hours. The accountability is the same.
Every cadence comes with a named CISO of record and a documented reporting line. Fixed monthly fee, scoped in writing.
Leadership on call
- Monthly leadership call
- Policy and risk-register ownership
- Quarterly board posture report
- Examiner and auditor correspondence
Running the program
- Everything in Advisory, plus a weekly cadence with your IT lead
- Vendor and AI risk oversight
- AI inventory and risk register
- Control evidence collection
- Annual Part 500 certification support
Your CISO, in the room
- Everything in Program, plus exam and audit lead
- Incident-response on-call
- Tabletop exercises
- An annual AI Exposure Sprint
- Board committee attendance
Add-on on any cadence: a quarterly AI posture report and agent inventory review.
- A named CISO of record, with a documented reporting line
- A 90-day plan against your current examiner, auditor, or customer deadline
- A board one-pager in your directors' language
- Resell tools or take vendor referral fees
- Staff your account with a junior bench
- Replace your IT team or managed provider; we direct them
Leadership with a track record.
boards and executive committees reported to.
annual SOC 2 Type 1 and Type 2 reports supported.
NYDFS Part 500 certifications filed or supported.
As of October 2026
Leadership the board can read.
“RedOps changed how our board looks at cyber risk. Instead of raw technical data and tool counts, our directors get clear, metrics-driven reporting tied to operational resilience and financial risk. We get enterprise-grade CISO leadership at a fraction of the cost of a full-time hire.”
“We were close to losing a multimillion-dollar enterprise deal over vendor security requirements and SOC 2. RedOps found our gaps, put the right controls in place without slowing the business, and guided us through the audit. We kept the account, and security became a selling point.”
Clients are identified by role and sector to protect their confidentiality.
Get a straight answer in 20 minutes.
Tell us the trigger: a board question, an examiner, a lost deal, or a CISO seat that's empty. You'll leave the call with a recommended scope, and a written proposal follows within two business days.