Choosing a provider
How to choose a fractional DevSecOps partner
There are four ways to get cloud, infrastructure and security owned: a full-time hire, a managed service provider, a freelancer, or a fractional team. This page says what each one is, when each wins, which checks to run on any provider, and who MatrixGard is not for.
- Registered company: NASHSMATRIXGARD OPC PVT LTD
- Published prices and a published ownership matrix
- Month to month, 30 days notice
Where founders are when they read this
- We have three quotes that look nothing alike, and we cannot tell what we are comparing.
- Everyone says senior and everyone says security. How do we check?
- We are about to hand someone the keys to production.
- If we change our mind later, how hard is it to leave?
These are the right questions, and each has an answer you can check before signing anything.
The four options, side by side
| Full-time hire | Managed service provider | Freelancer | Fractional DevSecOps team | |
|---|---|---|---|---|
| What you are buying | One person's full week | A defined scope, run to a contract | A person's hours, usually per task | Ownership of cloud, deployment and security within a monthly plan |
| Wins when | The work fills a full week every week, and you can wait for the hire | The scope is already well defined and mostly steady | You have one clear task and someone internal to direct it | The work is real, does not fill a role yet, and nobody internal owns it |
| Ask about | Cover when they are away, and breadth across all three disciplines | What happens to work outside the contracted scope | Continuity when they take another contract | What happens when the month's hours are used |
| Where the knowledge lives | With your employee, while they stay | Check the exit terms: whose accounts and tooling hold it | With the individual, unless you require documentation | Should be your repositories and accounts. Verify it |
On the full-time route, one hire is not an on-call rotation. Google's SRE book caps operational work at 50% of an engineer's time (chapter on being on-call), which is a useful yardstick for how much of a week operations should take. On the managed route, the joint advisory AA22-131A from CISA and partner agencies describes the managed service provider model and what to ask one about security. We compare the two outside options in detail in fractional DevSecOps or a managed service for a 10 person startup, and the hiring route in hire a DevOps engineer or use a fractional team.
Eight checks to run on any provider, us included
- A registered entity you can look up. In India the company register is public at the Ministry of Corporate Affairs.
- A named person who does the work. Ask who will be in your accounts, and talk to them before signing.
- Published prices, or a written quote that states the hours and what happens beyond them.
- A written ownership list: for each area, what they own, what is shared, and what is not theirs.
- An access model: read-only first, roles you control, changes through code, revocable in one step.
- Exit terms: the notice period, and where code, state, runbooks and credentials sit on the last day.
- An incident rule in writing: what is covered at 02:00 and what waits until morning.
- Stated limits. Ask what they will not do. A clear answer is a good sign.
The longer version, with where to verify each item, is in how to verify a fractional DevSecOps consultant before signing a retainer. For the exit question, see what happens to infrastructure knowledge if a fractional DevOps contract ends. CISA also publishes a short vendor assessment fact sheet written for small businesses.
What you can check about MatrixGard today
- Registered company: NASHSMATRIXGARD OPC PVT LTD, India.
- Cloud partner programmes at entry tier, stated as such: AWS Partner Network (Registered) and Google Cloud Partner Advantage (Member).
- Published prices, month to month, 30 days notice.
- A published ownership matrix: what we own, what is shared, and what is not ours.
- Open-source tooling you can read: Ghost-hunter, our cloud bill investigator.
- The incident rule: production down gets a response at any hour on every plan, everything else the next business day.
For what a retainer costs across the market, with sources, see what a DevOps or DevSecOps retainer costs per month in India.
If you choose us: the first two weeks
Before you sign
The free 20-minute call
With the engineer who would lead the work. Written findings follow, and they are yours whether or not you continue.
Days 1 to 3
Map what exists
Read-only access, and a written map of accounts, environments, pipelines, access and spend.
Days 4 to 5
Agree who owns what
A written ownership list: ours, shared, yours.
Days 6 to 14
First fixes and the monthly rhythm
The gaps that carry the most risk are closed first, then the routine starts: a shared channel, a monthly written report and runbooks in your repository.
What a MatrixGard retainer covers
- Cloud cost, tracked and reported every month
- Stable infrastructure: accounts, infrastructure as code, CI/CD, Kubernetes where you run it, monitoring
- Security: access, secrets, logging, vulnerability management for infrastructure and dependencies
- Technical readiness for SOC 2, ISO 27001 and DPDP, as a result of the above
The situation pages go deeper: your cloud bill jumped, a security questionnaire you cannot fully answer yet, and nobody owns cloud and security.
Who MatrixGard is not for
- You need a staffed team watching every alert around the clock. Our cover is production down at any hour, everything else next business day.
- Your engineering team is past roughly fifteen to twenty people, or ships many times a day with engineers blocked on the pipeline. That is the point to hire full-time, and we help with the hiring.
- You need someone to issue a SOC 2 report or an ISO 27001 certificate. Those come from a licensed CPA firm or a certification body. We do the technical preparation.
- You need application developers or extra hands for product work.
- You need someone on site every day. We work remotely.
- You want a promised result, such as a set saving or an audit pass. We commit to the work and to straight findings.
- You want the lowest hourly rate for one well-defined task. A freelancer is the better buy.
- You need independent testing and strict separation of duties delivered entirely by one provider. Those need more than one party, and we will tell you which parts we can hold.
If one of these is you, the call is still useful: you will hear which of the other three options fits and what to ask them.
Questions founders ask first
- Why not just hire a DevOps engineer?
- If the work fills a full week every week and you can wait out a hiring cycle, hire. If it does not fill a role yet, a fractional team gives you an owner now, and documented infrastructure to hand to your hire later. We help with that hire: the job description, the technical interview and the handover.
- Is a fractional team just a freelancer with a company name?
- The practical differences are the ones you can check: a registered company behind the contract, published prices, a written ownership list, an incident rule, and documentation that stays in your repositories. Run the eight checks on anyone, us included.
- How do we leave if it does not work out?
- Thirty days notice, month to month. Infrastructure as code, runbooks and reports already live in your repositories and accounts, so leaving is a matter of revoking access.
- Can we start with something smaller than a retainer?
- Yes. Start with the free 20-minute call. After that there are fixed-scope audits on the pricing page if you want a written review before any monthly commitment.
- Do you take on companies outside India?
- Yes. MatrixGard works remotely and takes on startups in India, Singapore, the UAE, the UK and the US, with international prices published on the pricing page.
- Do you guarantee results?
- No. We publish who we are not for instead, so you can rule us out before spending anything. What we commit to is the work, written findings and a straight answer when something is outside our scope.
Prices are published on the pricing page.
Run the checks on us. Start with a 20-minute call.
A free 20-minute call with the engineer who would lead your work. Written findings follow, and a straight answer on which of the four options fits your stage.
Book the free 20-minute callRelated reading
- How to verify a fractional DevSecOps consultant before signing a retainer
- Fractional DevSecOps or a managed service for a 10 person startup?
- What happens to infrastructure knowledge if a fractional DevOps contract ends?
- What a DevOps or DevSecOps retainer costs per month in India