Practitioners First.
Consultants Second.

After two decades leading security programs across semiconductor manufacturing, aerospace, defense, and technology environments, the decision to consult came down to a simple observation: the organizations that need security expertise the most are consistently underserved by the firms that claim to provide it. Too expensive, too generic, too focused on deliverables over outcomes. Parallax Risk & Security exists to do it differently.

This practice is built on real operational experience — building security programs from the ground up, navigating incidents under pressure, achieving compliance certifications that actually required changing how organizations operated, managing OT and ICS environments where uptime and safety constraints are non-negotiable, and communicating all of it to boards and executive teams in terms that drive decisions. That breadth is not accidental. Security problems do not stay neatly in one domain.

We serve two distinct client tracks. For defense contractors and organizations in the Defense Industrial Base, we deliver CMMC readiness, NIST SP 800-171 compliance programs, and ITAR advisory — built around the specific obligations and threat landscape of the DIB. For commercial organizations, we provide vCISO leadership, SOC 2 and ISO 27001 readiness, security assessments, and OT security programs tailored to manufacturing environments.

Engagements are structured as partnerships, not transactions. You work directly with the person you hired — not a project manager passing work to a junior analyst. We stay close to your environment, are direct about what we find, and measure success by your outcomes, not the thickness of our report.