A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →The TrazTech Associate Network is a bench of practitioners who take scoped pieces of client work: readiness, testing, cloud, privacy, AI governance and more.
Canadian companies bring us their SOC 2, ISO 27001, penetration testing and security programs. Here's what our pipeline shows right now.
From our CRM, refreshed daily. Open means proposals out, on hold, signed or in delivery. The yearly figure is the pace of the last 90 days of proposals, rounded to the nearest million. One engagement can involve several practices.
SOC 2, ISO 27001, HIPAA, PCI DSS, NIST CSF, CyberSecure Canada, security questionnaires and buyer reviews.
Compliance penetration testing, vulnerability assessments, AI and LLM red teaming, reviews of AI-built apps.
Cloud and AWS security reviews, vulnerability management, attack surface work, continuity and DR testing.
vCISO and interim CISO work, technical due diligence, threat and risk assessments, tabletop exercises.
PIPEDA, Quebec Law 25 and GDPR readiness, and outsourced privacy officer work.
AI governance, acceptable use policies, AI security and vendor risk assessments, ISO 42001 and EU AI Act readiness.
ISO 27001 internal audits.
Support roles too: engagement coordination, and report QA and technical writing.
An identity check and a short background declaration. We never ask for your SIN or banking details in the portal.
A credential you can use. Accepted associates are verified TrazTech Associates, with a public verify page and a badge for LinkedIn. Work is offered as client engagements come in, so it follows demand in your practice.
We're a small firm, so we compete on how we treat people. These aren't aspirations; our associate portal enforces them.
Once we accept your invoice, we pay it whether or not the client has paid us yet. Their payment is our risk.
Quality, communication and timeliness, one thing to keep doing and one to improve. No silent rankings.
Associate, Senior Associate, Lead, then the core team, with published criteria and your progress against them.
A realistic client engagement, not a CV screen, with a person on borderline results and one human review if you don't pass.
You see the scope, milestones and fee before you say yes. Declining never counts against you.
Quick paid tasks go round the practice in turn, never first come first served.
A TrazTech Principal reviews and signs off everything before the client sees it.
Earned on an assessment, with a public verify page for LinkedIn and your CV.
Practitioners with at least 3 years of relevant experience, who can give at least 5 hours a week, and whose current employment allows side work (or who aren't employed). You can be anywhere, though most of our clients are Canadian.
No. Associates are independent contractors. You choose the work orders you take, set your own availability, and there is no exclusivity.
It follows client demand in your practice, and it grows as the network does. We offer work as engagements come in, we're open with you about what we're seeing in your practice, and you can decline any offer without it counting against you.
Yes, please do. Once you're accepted you're a verified TrazTech Associate. Add it to LinkedIn as Associate, TrazTech (contract), link your public verify page, and use it on your CV and in proposals. It's a real credential, earned on a real assessment, and we give you a badge and a post you can edit.
Practitioners who already do this work: contract SOC 2 and ISO 27001 consultants, freelance GRC people, privacy specialists, cloud security engineers and contract penetration testers in Canada, and some outside it.
A simulated client engagement for a fictional company, built from the kind of work you would do for us. About 3 hours of work, with 72 hours to submit. Tools and AI assistants are allowed; we grade judgment, accuracy and how you communicate.
No. We tell you whether you passed. If you don't pass, you can ask for a human review.
Two things, both quick. We confirm your identity (a photo of your ID and a selfie, or a short video call if you prefer), and you complete a short background declaration in the portal. If a client's contract needs a formal police check for an engagement, we'll ask you for one then.
With your consent, clients see your name, practice and level on their team page while you're on their engagement, with a link to verify your credential. A TrazTech Principal signs off every deliverable.
It takes about five minutes. You'll get a link to continue by email.
Apply to the networkHiring TrazTech for your own security work? About TrazTech · Contact us