Retained security and identity lead

The work is clear enough. Nobody in the building is authorised to own it.

Four to six days a month, ongoing. Remote by default, with an on-site cadence agreed up front — the risk committee, the change board, the vendor reviews, the audit conversations.

01 · The problem it addresses

The roadmap is not the missing piece. The decision is.

Most firms your size know roughly what needs doing. What is missing is a person senior enough to decide: which risks you accept, what the access model is, whether that exception stands, which vendor you back, when a control is good enough and when it is not.

Without that person, decisions queue behind a CTO who has four other priorities, engineers make reasonable choices in isolation that do not add up, and the same questions get re-litigated every quarter. Hiring for it is awkward too: at your size there is not five days a week of decisions to take, so the role goes unfilled, or it gets bolted onto somebody who already has a job.

Without that person the work does not stop — it just stops converging.

The one-line test

Whose name is on the identity and access position?

If the answer is a person with the authority to decide, you do not need this. If it is a committee, a job title that also runs the platform team, or a shrug, this is the gap the retained lead fills.

The product in one sentence

Aevix holds the mandate: owns the identity and access position, takes the decisions the roadmap needs inside authority agreed with your board or executive, and represents that position to regulators, auditors and enterprise customers in language they accept.

02 · Holding the mandate

Five things that are ours to do, not to advise on.

POSITION

Own the identity and access position

The model, the standards, the exceptions, and what the firm is actually willing to accept — written down, and defended.

DECISIONS

Take the decisions the roadmap needs

Rather than advising someone else to take them. Inside authority agreed with your board or executive, and logged so they survive the meeting.

FORUMS

Sit where it matters

Your risk committee, your change board, the vendor reviews, the audit and customer-questionnaire conversations.

REPRESENTATION

Represent the firm’s access position

To regulators, auditors and enterprise customers, in the language they accept and with the evidence they expect.

STANDARD

Hold engineers and vendors to it

Including the uncomfortable conversations, which are usually the ones that have been waiting longest.

03 · How it runs

Agree the authority once. Then use it every month.

A retained lead only works if the mandate is real. The first month is spent making it so; every month after that is spent exercising it, in the forums where the decisions are actually taken.

1

The first call

Qualify

Is this an ownership gap, or a body of work with a finish line? The second is the programme lead. If the honest answer is that you need a permanent hire, we say so on the call.

2

The first month

Agree the mandate

What Aevix decides alone, what goes to the executive or board, and which forums the role sits in — agreed in writing with the people who grant the authority, not assumed.

3

Ongoing · four to six days a month

Hold the position

Decisions taken and logged. Forums attended. Exceptions ruled on. Regulators, auditors and enterprise customers answered. Engineers and vendors held to the standard.

4

Reviewed, not renewed by default

Keep it honest

The mandate is reviewed on a cadence you set. If the firm grows into a full-time role, we say so, help scope it and sit on the panel. If the decisions have run out, the engagement should end.

04 · Where it usually comes from

Three doors in. None of them is compulsory.

AFTER A DIAGNOSTIC

The ownership finding names the gap

The roadmap names the work. The one-page ownership finding names who can own it — and when the answer is nobody with the authority, this is the product that fits.

The diagnostic

AFTER A PROGRAMME

The step-down at the end

The same person who ran the programme stays on at a lower intensity to hold what it built — so the end state does not quietly unwind over the following year.

The programme lead

ON ITS OWN

For a firm that already knows what it needs to do

No diagnostic, no programme. The roadmap exists; the decisions are queuing. This is the shortest route in, and the one most firms your size are actually in.

Start here

05 · What it is not

Four things this is sometimes mistaken for

  • A body for hire. This is not a contractor filling a delivery gap four days a month.
  • An advisor on call. Advice you have to act on yourself is the thing you already have too much of.
  • A substitute for a permanent hire when you genuinely need one. Where the right answer is to hire, we will say so — and help scope the role and sit on the panel.
  • Hands-on engineering. Aevix leads and decides; your team and your vendors build.

06 · Why fractional is the right shape here

There is not five days a week of decisions to take

At 150 to 2,000 people the decisions are real and they are consequential, but they are not continuous. A full-time head of security at this size spends most of the week on work that is not the job you hired them for. Four to six days a month of someone who actually holds the authority covers the decisions that exist — and keeps the role from being bolted onto whoever already has one.

07 · What it costs

A fixed monthly fee for a named number of days

Agreed before we start. Priced so that the comparison is with the decisions going untaken, not with a full-time salary — because at four to six days a month it should never be the more expensive option. The figure is a conversation rather than a price list.

Next step

A 20-minute call to test whether this is an ownership gap at all.

If what you actually need is a permanent hire, or a programme with a finish line, we will tell you that instead.