Skip to content
Fincham Systems LLC

Remote across the United States

Senior judgment,not a ticket queue.

We design, build, secure and govern the systems an organization runs on: cloud platforms, software, automation, information security and audit readiness.

Eight service lines, one senior consultant. Seventeen years across infrastructure, security and engineering leadership, on your estate directly.

Scope your engagementSee what we do

17

Years in practice

8

Service lines, one practice

1

Senior engineer, start to finish

  • .NET and C#
  • TypeScript
  • JavaScript
  • React
  • C++
  • SQL Server
  • Azure SQL
  • PostgreSQL
  • Cosmos DB
  • Microsoft Entra ID
  • Microsoft Intune
  • Microsoft Defender XDR
  • Microsoft Purview
  • Microsoft Sentinel
  • Azure
  • Terraform
  • Azure DevOps
  • GitHub Actions
  • Azure OpenAI
  • Azure AI Search
  • Kubernetes
  • Power BI
  • Exchange Online
  • SharePoint
  • Microsoft Teams

The situation

Your estate works. Nobody can explain it.

Most organizations between 25 and 500 staff run a Microsoft estate that grew rather than got designed. It functions. It also has settings nobody can account for, access nobody has reviewed, and a configuration that exists only in the portal and in one person’s memory.

That is survivable until something forces the question: a security questionnaire, an insurance renewal, an acquisition, a departure, an incident. Then the absence of a written baseline stops being a background risk and becomes the project.

We build environments that can be explained, reproduced and handed over.

Services

Eight service lines, run as one practice.

Build and run are the same discipline. We work across both so the environment you get handed is the environment we designed.

All services
Project or retained

DevOps & CI/CD

Deployments that are boring on purpose.

Read the scope
Project or retained

Software Development

Software your team can still maintain in a year.

Read the scope

How we work

Four phases. The last one is the point.

Most engagements are sold on the build. Ours are designed around the handover, because an environment you cannot operate without us is not finished.

011 – 2 weeks

Scope

We look at what you have and write down what we would change first.

A fixed-price discovery. We review the environment, interview the people who operate it, and produce a written assessment with a sequenced recommendation. You own that document whether or not you engage us for the work.

Written assessment and sequenced plan

021 – 3 weeks

Design

Target state on paper before anything is built.

Architecture, control design and the decision record that explains why each choice was made over the alternatives. If the plan is not readable by someone who was not in the room, it is not finished.

Architecture and decision record

03Scoped per engagement

Build

Delivered in waves you approve, recorded as it goes.

Work lands in reviewable increments rather than one change window. Infrastructure is expressed as code in your repository. Every change is recorded with what it was before, which is the artifact your auditor will ask for.

Code, configuration and change record

041 week

Hand over

Runbooks, a working session, and no dependency on us.

We write the operating documentation, walk your team through it live, and rehearse the procedures that matter: recovery, rollback, onboarding. The measure of a finished engagement is that you could run the environment without us.

Runbooks and operating handover

Read how engagements run

Operating principles

What you can hold us to.

Four commitments that shape every engagement. They are also the four things most consultancies will not put in writing.

If it is not written down, it did not happen

Every engagement produces documentation as a deliverable, not as an afterthought. Configuration baselines, decision records, runbooks. Undocumented work is work you will pay for twice.

You get the senior engineer

The person who scopes your engagement is the person who designs it and the person who builds it. Nothing is sold by one party and delivered by a cheaper one.

You own everything

Code in your repository, infrastructure in your subscription, documentation in your hands from day one. No proprietary tooling, no license to renew, no knowledge that leaves when we do.

We tell you what not to do

Scoping includes the work we recommend against and the reasons. A consultancy that agrees with every request is optimizing for its own invoice.

Engagement models

Four ways to work with us.

Every service maps to one of these. Which one applies is agreed before anything is quoted.

Monthly

Managed service

Fixed monthly fee

We take ownership of an environment and hold it to a documented baseline. Defined scope, monthly reporting, no hourly billing.

  • Microsoft 365 Management
Defined start and end

Fixed-scope project

Fixed price, quoted after discovery

A bounded piece of work with agreed deliverables and a price fixed before it starts. You carry no risk on the estimate. Any service line can be run this way, not only the ones that default to it.

  • Any of the service lines
Monthly 8, 16 or 32 hours 3-month minimum

Retained advisory

Quoted by tier

A committed block of senior hours each month at a tier agreed up front. Every tier includes a monthly review call, a maintained risk register, and a reply within one business day. The hours can go to build work as readily as advisory, including ongoing software development.

  • InfoSec Consulting
  • Compliance & Audit Readiness
  • Software Development
As needed

Hourly

$500 per hour

Any service line, billed by the hour with no engagement wrapped around it. Architecture reviews, second opinions, incident post-mortems, a few days of development, or anything that would cost more to scope than to do.

  • Any of the service lines

Questions

The things worth asking first.

Including the one most firms would rather you did not ask.

Is Fincham Systems a one-person firm?

Yes. Fincham Systems is a single senior consultant, and that is deliberate. You are buying judgment and execution from someone with seventeen years in infrastructure, security and engineering leadership. What you are not buying is a sales conversation followed by delivery from whoever was available. The limit is honest: we take on a small number of concurrent engagements, and when capacity is full we say so rather than stretch.

What does an engagement cost?

Hourly work is $500 per hour and applies to any of the service lines, not just advisory. Retained advisory runs at 8, 16 or 32 hours a month on a three-month minimum, with the fee quoted against your scope. Managed services are a fixed monthly fee. Projects are fixed-scope with the price agreed before work starts. Discovery is fixed-price and quoted up front; project and retainer pricing follows discovery rather than preceding it, because a number given before anyone has seen the environment is a guess that someone eventually pays for.

Where are your clients based?

Across the United States. The work is remote by default, which is how it gets done efficiently, and on-site time is arranged where an engagement genuinely benefits from it when an engagement genuinely benefits from it. Discovery workshops, handover sessions and tabletop exercises usually do.

We already have an IT provider. Does that rule us out?

No, and it is a common arrangement. Managed service providers are built to run a help desk and keep the lights on. They are rarely staffed to design an Azure landing zone or prepare an organization for SOC 2. We define the boundary in writing before starting so there is no ambiguity about who owns which change.

What size organization do you work with?

Typically 25 to 500 staff. Large enough that the Microsoft estate has real complexity, small enough that there is no internal architecture function. Below that, a good managed service provider usually serves you better and we will say so.

How quickly can you start?

Discovery can usually begin within two weeks. Build work is scheduled around existing engagements, and we will tell you our real availability in the first conversation rather than after the contract is signed.

Start here

Thirty minutes, no pitch.

We review what you have and tell you what we would change first. If that is all you take away, the conversation still did its job.

Scope your engagement See what we do