What does a cloud security posture review cover?

Accounts, identity, network, data, and logging, across AWS, Azure, or Google Cloud. I map who and what can reach each resource, check it against the CIS benchmark and the provider's own security guidance, and rank every gap by what it exposes and what it costs to close.

Is this a penetration test?

No. A penetration test attacks a running application from the outside. This work reviews how your cloud is configured and then fixes it. The two complement each other. If you need a penetration test afterwards, I'll help you scope it and read the report.

Will it help with SOC 2, ISO 27001, or an enterprise security questionnaire?

It closes the gaps those reviews find and produces the evidence they ask for: audit logs, access policies, encryption settings, and tested backups. It is not an audit, and I don't issue certificates. Teams usually do this work first so the audit goes smoothly.

How long does cloud security hardening take?

Two variables set it: the size of the estate and how much of the remediation you want me to carry out. The assessment on a few accounts takes about two weeks. Remediation follows at the pace your team can absorb, usually a few weeks more. Until we've looked, the honest answer is: it depends.

All services

The consultancy of Jeff Kloythanomsup, Amsterdam

Cloud security hardening for EU startups

I find the gaps in your cloud accounts, identity, network, and data, rank them by what an attacker reaches first, and close them with your team.

Most cloud estates I open have the same shape. Nobody is careless. The accounts grew one urgent change at a time, and the security posture is whatever that history left behind.

An admin key from the first week still works. A bucket is readable from more places than anyone remembers. The audit log exists, but nobody reads it. A scanner will list four hundred findings and rank them all critical. That's not a plan, so the first job is finding the five that matter.

I've done this hardening at scale. For a Fortune 500 client I automated replication, versioning, and access hardening across 400+ S3 buckets in Python. Earlier I architected the multi-account AWS foundations for two mission-critical banking applications.

The method is the same at a startup. I map what you run and who can reach it, rank the gaps by blast radius and effort, and then fix them in Terraform alongside your engineers. The result is a posture you can show an enterprise buyer, and a team that knows why each control is there.

Book a call View CV

Reference architecture

How the pieces connect

An illustrative flow, not a diagram of a client environment.

The work starts with the dependencies and ends with a system the team can operate.

What's included

Posture assessment across accounts, identity, network, and data

I inventory every account, role, user, network edge, and data store, and who can reach what. The review covers the AWS Well-Architected security pillar and the CIS benchmark for your cloud. Azure and Google Cloud get the same treatment with their own controls.

Findings ranked by what an attacker reaches first, not by scanner count

A scanner report is the input, not the output. I rank each finding by what it exposes, how reachable it is, and what it costs to fix. The result is a short list in the order I'd close it, with the reasoning written down.

Least-privilege IAM, single sign-on, and no long-lived keys

Humans sign in through single sign-on with short-lived sessions. Workloads get roles scoped to what they do. The access keys that have been around since the first week get rotated out, with a plan for whatever still depends on them.

Encryption, backups, and storage access hardening, written as code

Encryption at rest with keys you control, public access blocked by default, versioning and replication where data loss would hurt. Every control lands in Terraform, so it survives the next account and the next engineer.

Logging and detection a small team will actually read

Audit logs in every account, centralised and retained. Managed threat detection turned on and tuned. Alerts for the handful of events that need a human, and nothing for the rest.

Remediation with your team, plus the evidence enterprise questionnaires ask for

I close the ranked findings alongside your engineers, so the fixes stay understood. Along the way I collect the evidence an enterprise security questionnaire or a due diligence review asks for, and write down what to watch after I leave.

Where I've done it

Every item here comes from my CV. View CV.

Senior Cloud Engineer, AWS consulting partner, 2021 to 2026
Hardened disaster recovery and data security for a Fortune 500 client by automating replication, versioning, and access hardening across 400+ S3 buckets in Python.
Senior DevOps Engineer, engineering agency, 2019 to 2020
Migrated mission-critical applications to AWS with Terraform and Terragrunt, removing a one-hour backup downtime window along the way.
Lead Cloud Support Engineer, AWS consulting partner, 2016 to 2018
Architected multi-account AWS infrastructure for two mission-critical banking applications on Fargate, Aurora, and ElastiCache.
Earlier roles, 2016 to 2020
Led a 10-member team managing 2,000+ production instances with 100% SLA compliance.
Amazon Web Services, 2017
AWS Certified Solutions Architect, Professional, and AWS Certified DevOps Engineer, Professional.

Tools I reach for

AWS IAM and IAM Identity Center, AWS Organizations and service control policies, CloudTrail, GuardDuty, Security Hub, AWS Config, KMS, VPC, security groups, and network ACLs, S3 Block Public Access, Prowler, CIS Benchmarks, Terraform, Python.

Other services

Cloud migration

I move teams onto AWS, Azure, or Google Cloud, or out of a setup they've outgrown. I map every dependency before anything moves.

Platform engineering

I make the cloud you already run calmer, cheaper, and understood by more than one person on the team.

AI integration

I put language models to work on the problems that matter in your product and back office, and I ship them to production.

Fractional cloud leadership

A senior cloud lead for 10 to 20 hours a week, long before a full-time cloud team makes sense.

What does a cloud security posture review cover?: Accounts, identity, network, data, and logging, across AWS, Azure, or Google Cloud. I map who and what can reach each resource, check it against the CIS benchmark and the provider's own security guidance, and rank every gap by what it exposes and what it costs to close.
Is this a penetration test?: No. A penetration test attacks a running application from the outside. This work reviews how your cloud is configured and then fixes it. The two complement each other. If you need a penetration test afterwards, I'll help you scope it and read the report.
Will it help with SOC 2, ISO 27001, or an enterprise security questionnaire?: It closes the gaps those reviews find and produces the evidence they ask for: audit logs, access policies, encryption settings, and tested backups. It is not an audit, and I don't issue certificates. Teams usually do this work first so the audit goes smoothly.
How long does cloud security hardening take?: Two variables set it: the size of the estate and how much of the remediation you want me to carry out. The assessment on a few accounts takes about two weeks. Remediation follows at the pace your team can absorb, usually a few weeks more. Until we've looked, the honest answer is: it depends.

Let's talk.

A 30-minute call, no pitch. We look at your current setup, your stage, and the thing that's bothering you about it. I give a straight opinion on what to change, what to leave alone, and whether the problem is the one it looks like. What's the one thing in your stack you'd fix tomorrow?

Book a call See pricing

Prefer email or phone? hello@netninjas.eu or +31 6 45984313