An independent practice, by design.

Twenty years, mostly in production

The practice is built on two decades that began in network engineering — infrastructure that had to stay up, meaning routing, switching, remote access, and the unglamorous plumbing everything else depends on. That grounding still shapes the approach: a control that breaks the business gets removed by the business.

From there the work moved up the stack — cloud and application security, identity and access management, vulnerability management, and eventually the governance side: control frameworks such as SOC 2 and ISO 27001, risk registers, and the executive conversations that decide whether any of it gets funded.

Much of that experience was earned inside regulated and high-scrutiny environments: a large law firm handling privileged client matter, investment management firms answering to institutional investors and their diligence teams, and a private family office. Different industries, same underlying problem — a small technical team carrying an obligation sized for a much larger one.

The gap was rarely a missing tool. It was that nobody senior had the time to sit with the problem end to end.

Ethercastle was founded to close that gap. Engagements are scoped and delivered by senior people — whoever assesses your environment is the person who understands it, and who stays with it.

The practice works on-site across San Francisco and Los Angeles, with remote engagements when possible.

We build as well as advise. Alongside client work the practice runs a production security-intelligence pipeline on AWS and Cloudflare — a useful check on what modern cloud architecture actually costs to operate and secure.

Every engagement is built to be handed back. The goal is a program your team can run without us — documentation, runbooks, and knowledge transfer are part of the work, not an upsell after it.