Pursuing professional independence pt 3 - Develop offerings and leads

I think most current GRC and security problems can be solved by changing the approach to them instead of throwing more headcount at them.

In part two of this series, I promised to explore how to build a sustainable 1-person consultancy that is not based on long-term, full-time T&M engagement with one customer at a time. Let’s give it a go!

GRC professionals are misdirected when relying on current, widely applied methodologies, frameworks and tooling. They don’t know what “good” or “done” looks like, so it appears that there is always more work! Adding headcount just means more compliance work — it will never stop.

My approach starts from this analysis:

1. Everyone agrees that compliance is not security and that security is the more important of the two.
2. Compliance somehow still becomes the main question from senior leadership.
3. Everyone thinks they agree on what “risk management” is, but almost no one has a specific decision in mind when they embark on an assessment.

My approach has two legs:

1. Modelling and automation —> Speedrun the unavoidable compliance problem to relieve resources for operations and security.
2. Objective and resource-based —> The outcome of risk analysis becomes forecasts and proposals instead of spreadsheets with a lot of items and no meaningful direction.

This approach enables a different, less costly type of commitment than the usual 1–3 full-time (external) resources billing T&M for 3–12 months. One part-time attached resource can get the same or better outcomes. I would like that resource to be me.

Having you join us one day a week has also reduced our risk and concerns at times when our own resources were stretched. You’ve always been able to step into the team and contribute from day one, which gives us valuable flexibility and resilience when we need extra capacity.

Just as importantly, you’re incredibly well liked and bring a positive energy that rubs off on the people around you.

So from my side, it has been a very easy setup.

— Rasmus Broeng Jørgensen, IT Risk Responsible and DPO, NBS A/S

My track record shows that I’m well positioned for solving these problems:

1. I’ve reduced cost and overhead by replacing software licences with free alternatives.
2. I’ve replaced manual work (data collection, workshops, manual reviews, arbitrary scoring) with consistent models and automation.
3. I’ve designed reporting that immediately induces trust rather than indifference.

What stood out was his ability to simplify complex ideas without sacrificing rigour. He helped us avoid several architectural pitfalls and over-complications, and he kept the entire approach rooted in real business impact — not just risk theory.

I’d highly recommend Mads to anyone looking for a thoughtful expert who can bridge strategy, modelling, and real-world applicability.

— Abderrahmane Smimite, PhD, Co-Founder & Managing Director, Intuitem

Just because I think I would be valuable to the market does not automatically generate revenue for me. While there are many logistical obstacles to making a living from my offerings, there is one that’s most critical and elusive:

GRC practitioners don’t seem to have bandwidth to explore alternative approaches to how they fulfil their roles — so they end up just asking for more headcount while never getting closer to reducing their load.

So how can I entice CISOs, Compliance Officers, Risk Managers, Project Managers etc. to try other approaches? By easing them into it, step by step.

Client journey
               Step Service                                     Commitment
               ┌───────────────────────────────────────────────────────────┐
               │ 6  Retainer and audit support                     ongoing │
            ┌──┴───────────────────────────────────────────────────────────┤
            │ 5  Projects: Framework/tooling, quantification  weeks–months │
         ┌──┴──────────────────────────────────────────────────────────────┤
         │ 4  Workshop: Teaching or decision analysis           0.5–2 days │
      ┌──┴─────────────────────────────────────────────────────────────────┤
      │ 3  30-min sounding board                                    30 min │
   ┌──┴────────────────────────────────────────────────────────────────────┤
   │ 2  Try a free app or template                                  30 min │
┌──┴───────────────────────────────────────────────────────────────────────┤
│ 1  Read a post or hear a talk                                   5–60 min │
└──────────────────────────────────────────────────────────────────────────┘

You can take your first step towards a more effective approach here:

• LinkedIn posts
• Podcasts: 1 episode on Spotify and 3 episodes on a YouTube playlist
• Return on Security Investment app
• Various templates

or jump directly to step 3 via mads@scopusrisk.com ;-).

So this is my three-part series on pursuing professional independence. My format and offerings will naturally mature and tighten over time. But I am confident that this is the road where there is a reasonable probability of success while I can keep it fun! Hopefully this pursuit will bring me to a position where I can choose exciting projects, be the owner of all my time, while still being able to pay all my bills.

PS. I may do a bonus post on the technical infrastructure of this. You know: building and deploying apps, having a website/shop, being able to be booked, etc.