Rajesh Kumar,
fractional security lead.
Fractional security lead (vCISO services) for startups. Metalink is my independent practice: you work with me directly.
Background
I am a principal cloud security architect with more than 25 years in infrastructure and security, 11 of them at T‑Mobile.
There I automated the move of more than 10,000 security groups into governed access packages, deployed just-in-time access across AWS, Azure and GCP, and built government cloud environments to NIST 800-53/171 and CMMC requirements.
In 2026 I led a startup's SOC 2 preparation, on a compliance platform, through to its Type I report, which was issued by an independent auditor. I have also implemented zero-trust network access with Tailscale.
On AI security I work from the public frameworks, the OWASP Top 10 for LLM Applications and MITRE ATLAS, at working-knowledge level. I wrote the AI governance model for an independent project.
Certifications
- CISMCertified Information Security ManagerISACA
- CCSPCertified Cloud Security ProfessionalISC2
- TOGAFCertified Enterprise ArchitectThe Open Group
- PMPProject Management ProfessionalPMI
Each can be verified with the body that issued it.
What I do not do
- I do not audit, certify or attest. A SOC 2 audit is performed, and its report issued, by an independent CPA firm that you choose.
- I do not run penetration tests. If your customer requires an independent manual test, it is arranged with a third party at cost.
- I do not provide round-the-clock monitoring or an on-call incident response service.
- I do not give legal advice, and I do not review contracts or data processing agreements as a lawyer would.
- I do not do staff-augmentation engineering. I give configuration guidance; your engineers make the changes.
- I do not write answers the evidence does not support, and I do not guarantee an audit outcome.
How I work.
You work with me.
The person on the first call is the person who does the work. No handoffs.
Fixed and published.
Fixed scope, fixed fee, written exclusions. Retainers run month to month with 30 days' notice.
Yours to keep.
Everything is handed over in your own storage and tools, and my access is removed at the end. No lock-in.
Deal waiting on a security review?
Book thirty minutes, or send me the questionnaire and I'll tell you what it will take.
- [email protected]
- Based
- Pacific Northwest