SOC 2 Examinations for SaaS Companies
Licensed CPA firm. Direct partner access. Big 4 and enterprise security background.
Enterprise prospects require SOC 2 before signing contracts. Get a credible, AICPA-standard report from a CPA who actually understands your tech stack — without an enterprise audit bill.
Why Tang Advisory
Most SOC 2 auditors come from one of two backgrounds: CPA firms that bring in IT consultants, or cybersecurity consultancies that partner with CPAs to issue reports. Tang Advisory brings both in one person — a licensed CPA with deep, hands-on cybersecurity expertise.
I've worked in Big 4 audit (PwC), served as lead assessor on SOC 2 examinations at Coalfire for AWS, Azure, Google Cloud, Microsoft 365, Google Workspace, Oracle Cloud, and IBM Cloud, and built cloud infrastructure at AWS. My background spans the full stack — from auditing the largest hyperscalers in the world to hands-on cloud security engineering. When I examine your controls, I'm not checking boxes — I'm evaluating your architecture with the same depth as your security team.
You won't spend hours explaining your cloud infrastructure to your auditor. I speak your language.
Credentials
20+ professional certifications across audit, security, cloud, and privacy.
CPA
WA & OR, since 2014
CISSP
Cybersecurity
CISM
Security Management
CRISC
Risk & Controls
CCSP
Cloud Security
CIPP/US
Privacy Law
CIPM
Privacy Management
HITRUST CCSPP
Healthcare Security
AWS Security Specialty
Cloud Security
AWS SA Professional
Architecture
SC-100
Microsoft Cybersecurity Architect
AZ-500
Azure Security Engineer
How It Works
A clear, predictable process from initial call to signed report.
Step 1: Scope Assessment
Free, 30 minWe'll determine which Trust Services Criteria apply to your product, whether Type I or Type II makes sense, and provide a firm quote.
Step 2: Readiness & Remediation
1-2 weeks, as neededGap analysis against the criteria. Policy templates, control implementation guidance, and evidence collection framework. Available as a standalone engagement or bundled with the examination.
Step 3: Examination
2-4 weeks for Type IFormal SOC 2 examination — walkthroughs, evidence review, control testing. You work directly with me throughout.
Step 4: Report Delivery
Signed SOC 2 Type I or Type II report, ready to share with enterprise prospects and procurement teams.
Type I vs. Type II
Type I
Point-in-time snapshot of your controls. Fastest path to a report — typically 4-6 weeks from kickoff.
Best for:
- Closing an enterprise deal quickly
- Establishing initial SOC 2 compliance
Type II
Controls tested over a 3-12 month observation period. Higher assurance.
Best for:
- Fortune 500 procurement requirements
- Regulated industries
- Demonstrating sustained security posture
Most companies start with Type I and graduate to Type II.
Who I Work With
I work primarily with SaaS companies from seed stage through Series C, and bootstrapped B2B software companies selling to enterprise customers.
Built for High-Growth SaaS
Large audit firms do excellent work — for companies that need enterprise pricing and rotating teams. If you're a 20-200 person SaaS company that needs a credible, AICPA-standard SOC 2 report with direct partner access and a CPA who understands your infrastructure, you're in the right place.
Frequently Asked Questions
Based in the Pacific Northwest. Serving SaaS companies nationally.
Ready to get SOC 2 certified?
Schedule a free 30-minute scope assessment. I'll confirm which criteria apply to your product and give you a realistic timeline and budget.