Late-August dedicated security hire timing (6 months post-Jasons departure)

Situation

Aligned with Steve in 1:1 that a dedicated security resource hire is appropriate in late August — six months after Jasons departure. Options on the table: full-time hire, fractional resource, or expanding the Shin Brothers role. Steve currently at 70% capacity on ISO 42001 documentation; workload expected to normalize after this week, with SOC 2 and ISO 27001 audits expected to be lighter.

Reasoning

Six-months-post-departure is the right window: it lets Steve carry the load through the heaviest compliance documentation crunch (ISO 42001 now), confirms the workload pattern post-audit-cycle (SOC 2 + ISO 27001 expected lighter), and avoids hiring before knowing whether the role steady-state is FTE-shaped, fractional-shaped, or absorbable into existing partner relationships (Shin Brothers). This also reads alongside the Atomicorp routing pattern (Apr 27 Route Non-Differentiating FTE Classes to Partners) — security/compliance functions are exactly the FTE class CIQ has been routing to partners. Holding the hire until late August lets Peter see whether the partner-route absorbs the demand or whether the gap is real-FTE-shaped.

Additional Context

Steves capacity at 70% on ISO 42001. Jasons departure was earlier this year (Feb-ish, six months before late August). Shin Brothers is an existing partner/fractional relationship being considered for expansion. Workload normalizing post-week-of-May-7.

Observed Evidence

Fathom Topic explicitly captures the timing (late August) and the three options. Steve and Peter aligned in real time.

Matching Patterns

Confidence Breakdown

Reasoning Depth Analysis