I provide high quality software security consulting for funded startups and enterprises - this includes technical penetration testing and source code review, bu

I provide high quality software security consulting for funded startups and enterprises - this includes technical penetration testing and source code review, but also various other things like parachuting in to help developers and managers and solving business/policy issues in the realm of "security." I differentiate my services on several grounds - higher technical proficiency than competitors (many of whom use automated scanners and call it a day) and greater involvement than a simple pen test. Like many people, I would tell you to frame yourself as someone solving a business problem rather than someone performing a pen test for a client. One is a valuable investment, the other is a commoditized item on a compliance checklist. I structure statements of work using clauses for 1. scope and definition of the project, 2. approximate dates, 3. rates, including terms of payment/invoicing, 4. limited liability, 5. various other boilerplate and project-specific minutia, such as how and when reports on findings are delivered, etc. I charge $2000 a day, or $10,000 per week. This is implicit - if you do the math you'll figure it out, but I really just give a final project-based price. A 50% deposit is taken at the beginning of the project and paid towards the final invoice (so 50% at outset, 50% on completion). I know there are many opinions on this; it works, so it's what I do. I have about five years of experience in information security specifically. Feel free to reply here, or reach out to me via email if you have more questions or want more guidance.