Security · Privacy · AI governance
Senior leadership for security, privacy and AI risk, without the full-time hire.
Stealth Worker is a small firm of senior practitioners some of us legally trained, with decades of hands-on security, privacy and regulatory experience. We step in as your fractional CISO, your Data Protection Officer or your AI governance lead, and we stay for as long as you need us.
- 15
- countries where we have worked with companies and projects
- < 1 month
- to bring multiple companies into GDPR compliance
- 8
- professional certifications across security, privacy, cloud and AI governance
- 5–40 hrs
- a week, sized to the role you need filled
Regimes and frameworks we work in
- GDPR
- CCPA and CPRA
- EU AI Act
- SOC 2
- ISO 27001
- ISO/IEC 42001
- NIST AI RMF
- HIPAA
- PCI DSS
- SOX
When clients call us
Usually, something has just become urgent.
Most engagements start with a specific pressure and a deadline. These are the ones we hear most often, and the role we take in each.
“An enterprise customer won’t sign until we pass their security review.”
We take over the questionnaire, close the gaps that matter and put a credible security lead in front of their team.
Fractional CISO“Our auditors arrive in ninety days and the controls aren’t ready.”
We build and evidence the controls for SOC 2, ISO 27001, HIPAA, PCI DSS or SOX, and stay through the audit.
Audit readiness“We sell into Europe and nobody here owns GDPR.”
We assign a dedicated DPO, run the initial DPIA and act as your Article 27 representative in the EU.
Fractional DPO · EU Representative“A regulator or a data subject has written to us.”
We help you answer accurately and on time, and fix what the letter exposed so the next one is routine.
Fractional DPO“The board wants to know how we are using AI, and whether we should be.”
We inventory what is in use, assess the risk and give the board a policy and an owner it can hold to account.
AI governance lead“Our CISO has left and the search will take months.”
An experienced security executive steps in quickly, keeps the programme moving and can help you hire the successor.
Interim CISO
Cybersecurity
Experienced security executives are hard to attract and harder to retain. Ours step into the role quickly, set direction, and either steer the team you have or build the right one from scratch. Our team holds CISSP and CISM, with professional-level AWS and Google Cloud certifications.
-
For hire
Fractional CISO
A named security executive who owns your programme: strategy, risk, board and customer conversations, vendor decisions and incident readiness. Part-time, with full accountability.
-
Audit and certification readiness
We design, implement and monitor the controls your auditors will test, and shorten the road to certification.
- SOC 2
- ISO 27001
- HIPAA
- PCI DSS
- SOX
-
Penetration testing
Certified testers matched to your stack. Reports carry an executive summary for leadership and detailed findings with fixes for engineers, and we work with your team until the findings are closed.
Privacy
Our Data Protection Officers are IAPP certified (CIPP/E, CIPM and FIP) and bring decades of hands-on security, privacy and regulatory experience. The advice is pragmatic, and written to be acted on.
-
For hire
Fractional DPO
A dedicated Data Protection Officer assigned to your organisation, covering the day-to-day duties of the role and standing in front of regulators, customers and your own board.
-
GDPR compliance
From first gap assessment to a working programme: records of processing, lawful bases, data subject requests, vendor terms and breach response.
-
CCPA and CPRA
California privacy done properly: notices, consumer rights handling, service-provider contracts, and the assessments the regulations call for.
-
DPIAs
Data Protection Impact Assessments for new products, new vendors and new uses of data, including an initial DPIA at the start of every DPO engagement.
-
EU Representative
If the GDPR applies to you and you have no establishment in the EU, Article 27 requires a representative there. We act as yours, from €1,500 a year.
-
Vendor and contract review
Data processing agreements, transfer terms and vendor due diligence, reviewed by people who understand both the clause and the system behind it.
AI governance
Your teams are already using AI, and your customers and regulators are starting to ask how. We give you a clear picture of what is in use, the rules it should follow, and someone accountable for both. Our team includes IAPP-certified AI Governance Professionals (AIGP).
-
For hire
AI governance lead
A senior expert who chairs your AI oversight, sets policy, reviews high-impact use cases and reports to the board, working alongside your security and privacy leads.
-
Inventory and risk assessment
Find every model, tool and vendor in use, classify the risk of each, and decide what needs controls, what needs a human in the loop and what should stop.
-
Policy and framework alignment
Acceptable-use policy, procurement questions and review workflows, mapped to the frameworks your customers will ask about.
- EU AI Act
- ISO/IEC 42001
- NIST AI RMF
Security, privacy and AI rules now overlap. We practise all three, so you get one accountable answer instead of three reports that disagree.
Why one firm
Credentials
Qualified in every field we advise on.
These are the certifications held across our team. They sit on top of decades of hands-on work and senior management roles at global companies.
- SecurityCISSPCertified Information Systems Security Professional, ISC2
- SecurityCISMCertified Information Security Manager, ISACA
- CloudAWSAWS Certified, Professional level
- CloudGCPGoogle Cloud Certified, Professional level
- PrivacyCIPP/ECertified Information Privacy Professional/Europe, IAPP
- PrivacyCIPMCertified Information Privacy Manager, IAPP
- PrivacyFIPFellow of Information Privacy, IAPP
- AI governanceAIGPArtificial Intelligence Governance Professional, IAPP
Legally trained, practically minded.
Some of our team hold law degrees. It means we read a regulation, a contract clause or a regulator’s letter the way a lawyer would, and then turn it into controls your engineers can build.
We work as security, privacy and governance advisors. Stealth Worker is not a law firm and our engagements do not include legal advice or legal representation; we work comfortably alongside your counsel.
How we work
No legalese. Just real partnership.
We understand the technology, the best practice and the regulation, and we have also sat in senior management roles at global companies. That is why our advice comes as decisions you can take, not memos you have to decode.
Listen
A first conversation about what you are facing: an audit, a regulator, a customer questionnaire, a board that wants answers.
Scope
A short written plan with a named lead, the outcomes we will own and the hours it will take.
Lead
We take the role and do the work alongside your team, from five to forty hours a week.
Hand over
A project ends with a programme your people can run. A long-term role continues for as long as it is useful.
- Senior people only
- You work with the practitioner who does the work, not an account manager.
- Certified and legally trained
- Eight professional certifications across the team, and law degrees among us, with decades of hands-on experience.
- Projects or long-term roles
- Engage us for a defined piece of work or as a standing member of your leadership team.
- Fast to effect
- We have brought multiple companies into GDPR compliance in less than a month.
Contact
Tell us what you are facing.
Send a few lines about your situation and we will reply with how we would approach it and who would lead it.
[email protected]