About Tier 1
Tier 1 is led by Michael Angelo, a cybersecurity and GRC specialist with more than 14 years in IT consulting and managed security.
Section 02
Michael embeds as a senior security lead, similar to an in-house head of security but scaled to the needs of a smaller firm. There is no junior analyst learning on your account and no rotating team that needs to be briefed again.
Discretion is part of the job. Tier 1 treats client information with the care expected in legal, advisory and private-wealth environments.
Section 03
Michael holds Lead Auditor credentials covering ISO 27001 information security, ISO 27701 privacy and ISO 42001 AI management systems. He also holds CISSP, CISM, CISA, CEH, CCNA and Microsoft certifications across Microsoft 365 and Azure.
Section 04
The public proof points below are drawn from the approved Tier 1 claim register.
Led certification programs for Eftsure, Crypto Tax Calculator, Cloud Services Australia, LinkSafe and SupportFusion, including two documented programs with zero non-conformities.
Guided Soprano Design and Whispir through SOC 2 Type II attestations, delivered DORA alignment for Soprano and supported Singapore IMDA requirements.
Served as incident response lead adviser for Ritchies IGA during a major data exposure event, from board briefings through regulatory notifications.
Provides ongoing security support to Australian law firms including Indigo Lawyers and LegalByte.
Section 05
Law firms, boutique consultancies and family offices can be too small for a full-time security hire and too exposed to leave security between general IT support and chance. Tier 1 fills that gap with direct senior ownership.
Section 06
The engagement is designed to help leadership make defensible decisions and help providers deliver the right controls. Complexity is reduced, but material risk is not softened or hidden.
Leadership hears what matters, why it matters and which decision is required in language the firm can use.
The scope follows the firm's risks and obligations rather than importing an enterprise program into a small team.
A control is treated as complete when its operation and ownership can be shown, not simply because a policy exists.
Existing staff, IT providers and advisers remain part of the solution, with boundaries and accountability made explicit.
A quiet first step
Talk directly with Michael about what your firm needs to protect and the practical next step.
Book a confidential call