Security consulting and advisory
Security programs you own, built to pass audit and scale with you.
Covenant Cloud Security helps organizations build and mature their own security programs. We bring practical, sustainable processes and the audit know-how to back them up, so your team can keep the program running after we step away.
What we offer
SOC 2 Readiness
Gap assessment, control mapping, and a prioritized roadmap to audit.
Benefit: Fewer surprises at audit time and a clear path to a clean report.
FedRAMP and HIPAA Gap Analyses
We map the requirements against what you already have and rank what matters most.
Benefit: You know exactly what stands between you and compliance.
Fractional CISO
Executive-level security leadership on a monthly retainer, scaled to your stage.
Benefit: CISO judgment and board-ready reporting without a full-time hire.
Application and Cloud Security
Secure SDLC guidance, threat modeling, and cloud and identity architecture reviews.
Benefit: Fewer vulnerabilities reach production, and security is built into engineering rather than bolted on.
Security Program Build-Out
Policies, governance, risk intake, and metrics designed from the ground up for your organization.
Benefit: Processes your team understands and can run without outside help.
Why organizations choose us
Capability, not dependence
We are a consulting firm, not a managed security provider. We build your team’s ability to run security, rather than handing it off.
Compliance you can defend
Controls designed to hold up under audit, drawn from frameworks like SOC 2, FedRAMP, HIPAA, ISO 27001, and PCI-DSS.
Engagements sized to fit
Time-boxed projects with clear deliverables, or ongoing advisory when you need it. No open-ended commitments.
Experience at scale
Two decades of security work on large, complex products, applied to organizations at your stage.
About Us
Joseph Eddings, CISSP
Founder of Covenant Cloud Security. I have spent about twenty years in cybersecurity and ten of those leading security teams and programs. I started Covenant to help organizations build security they can run for themselves, not to sell them an outsourced service.
My work centers on application security, cloud security, and compliance programs. I have built and led security programs at large technology companies, where I owned strategy and roadmaps, managed security engineers, and worked across engineering and product teams to make secure practices stick.
I’m strongest where security meets the way software is built: secure development lifecycles, threat modeling, identity and access management, and translating regulatory requirements into controls that engineering teams can actually implement.
Experience
-
Sr. Security and Compliance Product Manager, SAS Institute
2023 to present
Compliance requirements for a Kubernetes-based SaaS product, mapped across FedRAMP, PCI-DSS, HIPAA, SOX, and ISO 27001. Continuous control benchmarking and SOC 2 Type II evidence collection. -
Manager, IT Security and Risk, Dropbox
2019 to 2022
Led IT cybersecurity strategy and roadmap, including the company’s “Secure by Design” program and a Zero Trust program with microsegmentation policy. -
Cybersecurity Program Manager, Sony PlayStation
2016 to 2019
Corporate security governance and architecture review, reporting to the CIO and CISO.
Certifications
ISC2. Credential ID 499337
Certified Scrum Product Owner, Scrum Alliance
Frameworks I work in
SOC 2 | FedRAMP Moderate and High | HIPAA | ISO 27001 | PCI-DSS | NIST 800-53 | CSA Cloud Controls Matrix | OWASP SAMM | IRS Publication 1075
Companies where I’ve built security programs
Dropbox
Sony PlayStation
Prior and current employers where I worked on security.
Ready to talk about your security program?
Two decades of security leadership, backed by CISSP certification and hands-on work across application, cloud, and compliance.