Dallas, Texas · Technology consulting since 201635 services · 3 practices · 8 industries Technology in ActionPartnerships817-968-0523
Speak With an Expert

Technology · Compliance · Cloud security

Technology you can trust. Compliance you can prove.

We engineer the cloud, harden the systems and build the evidence that regulators, auditors and enterprise buyers demand. One senior team, from the first call to the clean report, and still there the year after.

Speak with an expertExplore our services
Built in Dallas since 2016
  • 10 yearsof technology consulting, compliance and cloud security delivery
  • CISA · CISMfounder-led by Lola Osoba, an ISACA-certified auditor and security manager
  • 35 servicesacross three practices and 8 regulated industries

01 · Payments · Banking · Resilience · 12 services

Financial Services Security & Compliance

Payment security, interbank messaging and operational resilience for institutions that move money.

  • PCI DSS 4.0.1 readiness
  • SWIFT CSCF
  • DORA & NIS2
  • Scan remediation
Explore the practice

02 · AI · SOC · ISO · FedRAMP · CMMC · 12 services

AI Governance, Cloud & Digital Trust

Governance for artificial intelligence, assurance for cloud services and the attestations customers ask for.

  • Cloud security engineering
  • SOC 1 & SOC 2
  • ISO/IEC 27001 & 42001
  • FedRAMP & CMMC readiness
Explore the practice

03 · Testing · Ransomware · Continuity · 11 services

Offensive Security & Enterprise Resilience

Adversarial testing that finds what matters, and the resilience disciplines that keep the business running.

  • Penetration testing
  • AI red teaming
  • Ransomware resilience
  • Continuity & privacy
Explore the practice

The firm at a glance

Work that holds up the first time a skeptic reads it.

10
years in business, founded in Dallas in 2016
35
service lines, each with its own method
18
selected engagements on record, every client confidential
8
regulated industries served
PCI DSS 4.0.1SWIFT CSCFDORANIS2SOC 1SOC 2ISO/IEC 27001ISO/IEC 42001EU AI ActNIST AI RMFFedRAMPCMMCNIST SP 800-171HITRUSTNIST CSF 2.0HIPAACIS ControlsPCI DSS 4.0.1SWIFT CSCFDORANIS2SOC 1SOC 2ISO/IEC 27001ISO/IEC 42001EU AI ActNIST AI RMFFedRAMPCMMCNIST SP 800-171HITRUSTNIST CSF 2.0HIPAACIS Controls

What we do

Three practices. One standard of evidence.

All 35 services

How we work

One method. Every engagement.

The same five phases run through every practice, from a cloud build to a compliance program. That is why our evidence survives the first hard question.

  1. 01

    Discover

    Establish what is genuinely in scope.

    Most failed assessments are lost at the scoping stage. We trace how data, money and decisions actually move before anyone writes a control test.

  2. 02

    Assess

    Test controls against the requirement and against reality.

    A policy that says the right thing is not a control. We sample, observe and test configuration so that every conclusion rests on evidence a skeptic would accept.

  3. 03

    Remediate

    Fix causes, not symptoms.

    We sequence remediation by risk and dependency, then work beside your engineers until each fix is designed, built and owned.

  4. 04

    Validate

    Prove it to a skeptic.

    Remediation is complete only when it has been retested. Validation produces an evidence pack that an auditor, regulator or acquiring bank can follow without a guide.

  5. 05

    Sustain

    Keep it true between assessments.

    Controls decay quietly. A light-touch operating rhythm keeps evidence current, catches scope drift early and makes next year’s assessment unremarkable.

See our approach

Find your starting point

Answer three questions. We’ll show you where to start.

17 services to explore
Three consultants in discussion around a meeting table
A team reviewing findings together on screen
Senior practitioners on every engagement

Who we are

Engineers who think like auditors. Auditors who build like engineers.

MarkTillson was founded in Dallas in 2016 for organizations that cannot afford to get security wrong: banks, payment companies, cloud and AI providers, healthcare, government and critical infrastructure. Our clients answer to a regulator, an auditor, a buyer or an attacker, and usually to more than one.

We do the technology work and the compliance work together, so the controls we design are the controls that actually run. The practitioner who scopes your engagement is the practitioner who delivers it.

About MarkTillson
  • Founded 2016Headquartered in Dallas, Texas
  • CISA · CISMFounder-led, ISACA-certified leadership
  • Engineering + complianceOne team builds it and proves it
  • Confidential by defaultWe never name a client
Lola Osoba, CISA, CISM, Founder of MarkTillson
Lola OsobaCISA, CISM · Founder

A note from our founder

Compliance is not paperwork. It is a promise your systems make to your customers. Our job is to make sure that promise is true, and that you can prove it on the day someone asks.

Lola Osoba, CISA, CISM · Founder

Lola Osoba built MarkTillson on a simple standard: every control we design must work in production, and every conclusion we sign must stand up to a skeptic. Ten years later, that standard still decides who we hire and what we deliver.

Meet our leadershipRead our story

Industries

Sector depth where trust is audited and attacked.

Selected engagements

Results on record. Clients off the record.

All 18 projects

Technology in action

Don’t take our word for it. Watch the work.

Six interactive demonstrations show how we scope, test, prioritize and map evidence: vulnerability prioritization, PCI DSS scoping, multi-cloud posture, AI governance, DORA resilience and evidence mapping. Each one runs on synthetic data, entirely in your browser.

Explore the demonstrations

Insights

Written by the people who do the work.

All insights
Colleagues celebrating a result together at a desk
A consultant laughing with colleagues

Careers

Do the work others rely on.

Graduate, experienced and senior pathways into technology consulting, cloud security engineering, compliance and offensive security. You learn beside certified practitioners, on engagements where the result is read by regulators, boards and buyers.

Explore careersOpen roles

Speak with a practitioner

Let’s prove it

Tell us what is coming: an audit, a new regulation, a cloud migration, a customer’s questionnaire or an attacker. A senior practitioner will reply, usually within one business day. Prefer to talk? Call 817-968-0523.

Prefer email? Write to conversations@marktillson.com.