Secure clouds. Tuned security platforms. One engineer behind both.

Bold City Cyber builds and hardens AWS, Google Cloud, Azure and Microsoft 365 with Terraform. It keeps CrowdStrike Falcon, Tanium and Qualys fully deployed and tuned. Every engagement is led by founder Travis Nichols. He is a former Technical Account Manager at all three security vendors, and he is AWS Partner Technical Accredited.

Book a free 30-minute consult Start with a fixed-fee Cloud Baseline or Platform Health Check

Based in Jacksonville, FL · Working with teams across the US

#security-report

Bold City CyberAPP

Weekly security report for acme-co

Cloud and security platforms, compared with last week

CloudAWS · Google Cloud · Azure28 of 31 Terraform guardrails passing↑ 12% vs last week

PlatformsFalcon · Tanium · Qualys428 of 430 hosts covered↑ 4% vs last week

↓ Risk score 11 pts · ↑ Sensor coverage 4% · ↓ Open findings 38% · ↓ Patch time 27%

Risk score over time

Risk score

Risk score over time. The y-axis is Risk score and the x-axis is Day, Monday through Friday. The solid line falls from 42 on Monday to 31 on Friday. The dashed line ends at 42.

Day

This weekLast week

Risk score fell 11 points, from 42 to 31. Terraform guardrails passed 28 of 31 checks. Falcon, Tanium, and Qualys covered 428 of 430 hosts.

Sample layout · fictional data
10 yearsin cybersecurity and cloud
AWS · Google Cloud · Azurebuilt in Terraform
Former TAMat CrowdStrike, Tanium & Qualys
AWS Partner Technical AccreditedCrowdStrike Certified Falcon Administrator · Tanium Certified Operator

Clouds sprawl. Security tools drift.

Most cloud environments grow one project at a time. Shared admin roles linger. Resources are built by hand. Logging never gets turned on. CSPM findings pile up. Most security platforms drift the same way. Sensors stop reporting. Patch waves stall. Scans skip half the network. Conditional Access gaps let phishing through. Both problems have the same fix. You need an engineer who builds it right, codifies it and keeps it tuned. That's what Bold City Cyber does. The work covers your cloud and your security stack.

Services

Two pillars, one engineer.

Cloud engineering and security platform engineering are equal halves of the work. They're stronger together. Each engagement starts with a fixed-fee assessment. The quote comes after a free 30-minute call, so you see every gap before you commit. A monthly plan keeps things clean after that.

01

Cloud Engineering & Security

AWS · Google Cloud · Azure · Microsoft 365 / Entra ID · Terraform

Cloud environments designed, built and hardened as infrastructure as code. Your team can read, review and maintain them.

  • Foundations: landing zones and account/project/subscription structure
  • Identity: least-privilege IAM, SSO and role cleanup
  • Infrastructure as code: Terraform modules and policy guardrails (AWS SCPs, Google Cloud Org Policies, Azure Policy)
  • Workloads: Kubernetes (EKS/GKE) and container hardening, CI/CD and DevSecOps checks
  • Visibility: logging, alerting and CSPM findings triage and remediation
  • Microsoft 365 / Entra ID: Conditional Access and phishing-resistant MFA. Privileged role cleanup (PIM) and OAuth app consent cleanup.
Start with an assessment
Cloud Security Baseline2 weeks, one cloud. Review, findings and a prioritized fix plan.
Multi-Cloud Security Review3 weeks, across AWS, Google Cloud and Azure.
Then stay covered
Fractional Cloud EngineerMonthly builds, fixes, drift reviews and on-call help.
Get a Cloud Baseline
02

Security Platform Engineering

CrowdStrike Falcon · Tanium · Qualys

Hands-on engineering for the security platforms you already own, from someone who supported them from the vendor side.

  • CrowdStrike Falcon: Sensor coverage, plus prevention and update policies. Exclusions and custom IOAs. SIEM integration mapped to MITRE ATT&CK.
  • Tanium: client health, Patch and Deploy automation, Comply/CIS benchmarks, module rollouts
  • Qualys VMDR: authenticated scans, dynamic tagging, risk-based prioritization
  • Sensor and agent rollout: Falcon and Tanium deployment, coverage gap checks and clean uninstall/reinstall
  • Across all three: Findings that turn into patch waves and tickets. Also upgrades, migrations and admin backup.
  • Health reviews: a named engineer each month for tuning and a quarterly roadmap
Start with an assessment
Platform Health Check1–2 weeks, one platform.
Multi-Platform Health Check2–3 weeks, including the gaps between platforms.
Then stay covered
Dedicated Platform EngineerA named engineer each month. The work covers health reviews, tuning, upgrades, admin backup and a quarterly roadmap.
Get a Platform Check

Where the pillars meet

Falcon Cloud Security and CSPM findings get the Terraform fixes they need. Qualys and Falcon findings in cloud workloads go to the right patch or IaC change. Entra identity controls protect both the cloud console and the endpoint. One engineer sees the whole picture.

Compliance

Compliance engineering in your cloud and on your endpoints.

I implement the technical controls behind your framework. That covers cloud guardrails, identity and your security platforms. I automate the evidence so audits stop being fire drills.

  • PCI DSS 4.0.1 gap assessment: Cardholder data environment scoping and scope reduction in hybrid and cloud environments. Segmentation (Req. 11.4) and the future-dated requirements. An evidence package structured for your QSA.
  • HIPAA Security Rule: technical safeguards in cloud, identity and endpoints; risk analysis support; remediation plans
  • SOC 2: technical readiness and continuous evidence from AWS, Google Cloud, Azure, Entra and your endpoint tools
  • NIST 800-53 / 800-171 and CMMC Level 2: technical control implementation and mapping
  • CIS Benchmarks: through Terraform guardrails, Intune and Tanium Comply

I'm a technical implementer, not a QSA, C3PAO or CMMC assessor. I don't issue attestations. I work alongside your auditor, assessor, vCISO or GRC firm.

Ask about a fixed-fee PCI DSS 4.0.1 gap assessment

AI security

AI and LLM security, from the cloud up.

Find where AI is in use across your company. Secure the cloud services your AI apps run on. Test what you ship.

  • Guardrails, IAM and logging for Amazon Bedrock, Azure OpenAI and Google Vertex AI
  • LLM app and agent testing against the OWASP Top 10 for LLM Applications (prompt injection, data leakage, excessive agency)
  • A shadow AI inventory, using the Falcon and Tanium telemetry you already have
  • An AI use policy mapped to the NIST AI RMF
Start with an assessment
AI Usage & Policy Review2 weeks.
AI App Security Assessment2–3 weeks.
Then stay covered
AI Security Oversight
Book a free 30-minute consult

Partners

White-label cloud and security engineering for MSPs, MSSPs and vendor partners.

Need AWS, Google Cloud, Azure or Microsoft 365 engineering for your clients, without a new hire? Or CrowdStrike, Tanium or Qualys depth? I deliver behind you. I work white-label under your brand, or as a named subcontractor. I work in your tools, your process and your templates. I don't solicit your clients. It's in writing.

  • Who I work with: MSPs, MSSPs and MDR providers. Also cloud consultancies, CrowdStrike/Tanium/Qualys partners, and GRC and vCISO firms.
  • Commercial models: per-project fixed fees or a reserved block of hours
  • Scope: unclassified engineering work only

Talk partnership

Results

What you get when the work is done

Every engagement ends with something you can see, measure and keep. That applies whether the work is in your cloud or your security platforms.

Cloud guardrails, written in Terraform

Least-privilege IAM, landing zones and policy guardrails across AWS, Google Cloud and Azure. They're defined as code, peer-reviewed and handed to your team to own.

Every endpoint covered and reporting

CrowdStrike Falcon sensors and Tanium clients reconciled against your real asset inventory. Missing, stale and unmanaged hosts are found and brought back.

Identity that holds up

Microsoft 365 and Entra ID hardened with Conditional Access, phishing-resistant MFA and cleaned-up admin roles. Changes are rolled out in stages so nobody gets locked out.

Patch cycles that finish

Tanium Patch and Deploy rings that complete on schedule. Qualys findings flow straight into patch waves and tickets instead of sitting past SLA.

Fewer, better alerts

Detections, exclusions and cloud security posture findings tuned to your environment. Your team sees the alerts that matter, and they land in your SIEM.

Audit-ready evidence

Controls for PCI DSS 4.0.1, HIPAA, SOC 2 and NIST. Evidence is collected automatically from your cloud and security tools, so the next audit isn't a scramble.

Drawn from 10 years of hands-on work across security vendor and in-house roles. Bold City Cyber does not publish client case studies without written permission.

Book a free 30-minute consult

About

I've built the cloud and supported the tools from the vendor side. Now I do both for you.

I'm Travis Nichols. I've spent ten years in cybersecurity and cloud. I was a Network Security Manager at Transcor Data Services. I ran a PCI DSS 4.0.1 program across more than 50 hybrid-cloud systems, built zero-trust payment processing, and passed the PCI audit with zero findings. Before that, I was a Technical Account Manager at CrowdStrike, Qualys and Tanium. I helped enterprise teams deploy, tune and get real value from those platforms.

Today I build and harden AWS, Google Cloud and Azure environments in Terraform and Kubernetes. I secure Microsoft 365 and Entra ID. I keep CrowdStrike, Tanium and Qualys doing their job. I founded Bold City Cyber in Jacksonville in 2024 so growing companies, and the MSPs and partners who serve them, get the hands-on attention large enterprises get from their vendors. I lead every engagement myself. I also publish a daily internal threat intel briefing.

AWS Partner Technical Accredited · CrowdStrike Certified Falcon Administrator · Tanium Certified Operator · BAS, Florida State College at Jacksonville

AWSGoogle CloudAzureMicrosoft EntraTerraformKubernetesCrowdStrikeTaniumQualysPCI DSS 4.0.1AI security

Connect on LinkedIn

How we work

You'll always know what's being worked on.

The work is visible from week one, whether it's a Terraform change or a Falcon policy. You start with a clear report. Then you get a steady rhythm of updates, calls and reviews with the engineer doing the work.

  • 01Week 1–2A health check report. Leadership gets a one-page summary. Every finding is ranked with an owner and a fix date.
  • 02Every weekUpdates in your Slack or Teams on what changed, what's next and anything that needs a decision.
  • 03Bi-weekly or monthlyCadence calls with your engineer to review open work and plan the next sprint.
  • 04Every monthA short health report. It covers cloud posture and platform coverage, plus open findings and trends.
  • 05Every quarterA review of progress, risk and the roadmap ahead. It's ready to share with leadership.

Process

From first call to steady coverage.

01

Intro call

30 minutes

A scoped proposal follows in 2 business days.

02

Fixed-price assessment

Weeks 1–3

Cloud Baseline, Platform Health Check, or both. It ends with a report and a walkthrough.

03

Monthly plan

Ongoing

Fractional Cloud Engineer and/or Dedicated Platform Engineer.

An extension of your team

Work happens in your Slack or Teams, your ticketing and your change process.

Cloud and security tools, one engineer

Infrastructure as code and security platform tuning from the same person, so fixes don't fall between teams.

Fixes, not just findings

Every finding comes with its fix. That fix may be Terraform, a policy, tuning or patch waves. It is documented so your team can own it.

Founder-led, upfront terms

Every engagement is led by Travis, not handed to a junior team. Assessments are fixed-price. Monthly plans are a flat fee. There is no license reselling. You can cancel with 30 days' notice.

Book a free 30-minute consult

FAQ

Common questions.

Something else on your mind? Send a note and I'll answer within a business day.

Q.01What services does Bold City Cyber offer?

Two equal pillars. One is cloud engineering and security on AWS, Google Cloud, Azure and Microsoft 365/Entra ID, built in Terraform. The other is security platform engineering for CrowdStrike Falcon, Tanium and Qualys. Around those sit compliance engineering for PCI DSS 4.0.1, HIPAA, SOC 2, NIST 800-53 and CMMC Level 2, plus AI and LLM security.

Q.02What's included in a Cloud Security Baseline or a Platform Health Check?

Both are fixed-fee reviews. A Cloud Security Baseline takes two weeks for one cloud. It covers IAM, guardrails, logging and CSPM findings, and it includes a prioritized fix plan. A Platform Health Check takes one to two weeks for one of CrowdStrike, Tanium or Qualys. It looks at coverage, policy, workflows and integrations. Each ends with a leadership summary. Every finding is ranked with an owner and a fix date.

Q.03Which clouds do you work in, and do you write Terraform?

AWS, Google Cloud and Azure, plus Microsoft 365 and Entra ID. Yes. Guardrails and infrastructure are delivered as Terraform your team can maintain. I'm AWS Partner Technical Accredited.

Q.04How much does it cost?

Every assessment is a fixed price. After a free 30-minute call, I send a written quote within two business days. The quote is based on the size of your environment and what's in scope. Monthly plans are a flat fee you can cancel with 30 days' notice.

Q.05Do you work white-label for MSPs, MSSPs and vendor partners?

Yes. I deliver cloud and security platform work under your brand, or as a named subcontractor. I work in your tools and your process. I don't solicit your clients.

Q.06Are you affiliated with a vendor, or a PCI QSA or CMMC assessor?

No. Bold City Cyber is independent and doesn't resell licenses. I previously worked at CrowdStrike, Tanium and Qualys as a Technical Account Manager. I'm not an assessor. I implement the technical controls and prepare the evidence alongside your QSA, assessor or GRC firm. I don't hold a security clearance. My work is unclassified.

Q.07Are you based in Jacksonville?

Yes. Bold City Cyber is based in Jacksonville, FL, and works remotely with teams across the US. Companies in Jacksonville and Northeast Florida can meet in person.

Contact

Let's find the gaps before someone else does.

Tell me about your environment. Include your clouds (AWS, Google Cloud, Azure, Microsoft 365) and your security tools (CrowdStrike, Tanium, Qualys), plus any compliance or AI goals. I'll reply within one business day with a few times to talk.

hello@boldcitycyber.com

Jacksonville, FL · Working with teams across the US

No sales pitch. One business day reply.