A half-day workshop for founders and security leads who need a SOC 2 Type II report without grinding their roadmap to a halt. We cover scoping, evidence automation, vendor selection (Vanta/Drata/Secureframe), and the audit gauntlet itself, with the exact playbook we use across 14 Drexus client engagements.
A half-day workshop for founders and security leads who need a SOC 2 Type II report without grinding their roadmap to a halt. We cover scoping, evidence automation, vendor selection (Vanta/Drata/Secureframe), and the audit gauntlet itself, with the exact playbook we use across 14 Drexus client engagements.
For: Founders · security · engineering-manager
Senior AI Engineer, Drexus
Senior AI Engineer at Drexus. Led 20+ SOC 2 Type II programs from kickoff to clean opinion. Ex-Big Four auditor before pivoting to engineering.
Coffee + intros
30 min
Scoping that doesn't sink you (and why most teams over-scope)
45 min · Murat Umutlu
Evidence automation: what to wire, what to skip
45 min · Murat Umutlu
Break
15 min
Vendor selection: Vanta vs Drata vs Secureframe vs DIY
30 min · Murat Umutlu
The audit itself + common pitfalls
30 min · Murat Umutlu
Q&A + 1:1 office-hour booking
15 min · Murat Umutlu
Every week another startup wakes up to a $40k bitcoin-mining bill in CloudTrail. This workshop walks through the exact controls we put on every AWS account at Drexus: SCPs, IAM Identity Center, root account hygiene, key rotation automation, GuardDuty + Detective wiring, and the Slack-paged runbook for when something does go wrong.
The methodology workshop. How to design, write, and operationalise a weekly receipt that replaces every status meeting in your org. Includes the 6-section template, the three failure modes we've seen, and the exact rollout plan we run with new clients in the first 30 days.
A no-fluff Thursday workshop on standing up production-grade cloud infrastructure on AWS. Walk out with our open-source Drexus Cloud Boilerplate (Terraform + GitHub Actions + a hardened VPC) wired to your account and the Friday Receipt template you'll use to track it.