Evidence first
Opinions are useful; proof changes decisions. We show our work, including the parts that make us uncomfortable.
About Blackglass
Built by people who have answered the 2 a.m. call.
We started Blackglass after years of incident response, watching the same avoidable failures repeat across otherwise well-funded organizations. The firm exists to make those failures rare.
Founded 2016
74 practitioners
3 SOC regions
Our story
Operator-led from day one.
Our founders met on a ransomware response that had already been mishandled for three days. The organization had every major security product deployed and still could not answer basic questions: which identities were compromised, which backups were clean, who was allowed to make decisions.
That experience shaped the practice. We hire people who have run production security operations, give them direct access to clients, and measure success by incidents contained and controls verified — not tickets closed.
Today Blackglass supports financial services, healthcare, logistics, and infrastructure teams across nineteen countries. We remain deliberately small enough that every client knows their analysts by name.
2016Founded in San Francisco
19Countries served
94%Client retention, 3-year average
The Blackglass operating principles
What clients can expect
Direct access
You talk to the operator
The analyst who worked your case briefs you. No account layer to translate findings.
Honest scope
We decline work we cannot do well
If a request is outside our expertise or would not reduce risk, we say so and suggest alternatives.
Measured claims
Evidence accompanies every assertion
Coverage, severity, and readiness statements are backed by reproducible observations.
Values
Four commitments we do not trade away.
These are not wall posters. They are the criteria we use in hiring, escalation, and client conversations.
Ownership without ego
If we miss something, we say it plainly and fix the process that allowed it. Blame is not a control.
Adversary mindset
We test how controls fail, not whether they exist in a spreadsheet. The attacker gets a vote.
Calm under pressure
Incidents reward composure. Our teams train for decision-making when information is incomplete.
Milestones
A decade of containment.
Growth has been intentional. We add a capability when clients need it and we can staff it with senior practitioners, never before.
Blackglass is independently owned. We do not resell products or take vendor commissions, which keeps our recommendations neutral.
2016
Founded in San Francisco
Two incident responders begin offering fixed-scope response support to mid-market companies.
2018
First 24/7 MDR retainer
The monitoring practice launches with three analysts and a strict 15-minute escalation standard.
2020
Remote-work response program
Identity-first controls and zero-trust assessments become a core service line during the shift to distributed work.
2022
London office and ISO 27001
European operations open, and the firm completes ISO 27001 certification and a SOC 2 Type II audit.
2024
Triage acceleration
Machine-assisted enrichment reduces routine investigation time by half. Human analysts retain every containment decision.
2026
1,480 incidents contained
The team grows to 74 practitioners across three regions while maintaining a named-analyst model.
Leadership
The people accountable for your program.
Senior practitioners stay involved after the sales conversation. That is the point.
Mara Okonkwo
Co-founder & CEO
Former incident response lead for a global insurer. Built Blackglass around the principle that clients deserve direct access to the operator.
Julian Reyes
Co-founder & CTO
Detection engineer and recovering sysadmin. Designs telemetry pipelines that stay useful when volume triples during an incident.
Priya Raman
VP, Detection Engineering
Leads the rule library and purple-team validation program. Previously built SOC content for a cloud-native bank.
Tomas Lind
Head of Adversary Simulation
Runs red-team and assumed-breach engagements. Specializes in identity paths and physical-social attack chains.
Certifications & accreditations
SOC 2 Type II
ISO 27001:2022
CREST accredited
OSCP · OSCE · CISSP team
Cyber insurance panel
Audit reports and certificates are available under NDA during procurement review.
Where we work
Three operations centers with follow-the-sun coverage, plus embedded consultants for on-site engagements.
San Francisco · HQ
Americas SOC and executive team
Austin · Response
Incident response and forensics lab
London · EMEA
European SOC and adversary simulation
Careers
Do the work you trained for.
Small teams, direct client contact, and time to investigate properly. We hire practitioners, not seat fillers.
| Role | Location | Type | Team |
|---|---|---|---|
| Senior Detection EngineerRemote · US or EU | Distributed | Full-time | Detection Engineering |
| Offensive Security ConsultantLondon, UK | Hybrid | Full-time | Adversary Simulation |
| Incident Response LeadAustin, TX | On-site / hybrid | Full-time | Response |
| Security Program ManagerSan Francisco, CA | Hybrid | Full-time | Client Services |
No matching role? Send a short note about what you are good at — we keep a warm bench for exceptional practitioners.
Work with us
See whether we are the right fit.
A conversation with an operator, not a discovery call with a sales team.