Freelance security-adjacent work dies of vagueness more often than it dies of difficulty. The client says “help us with SecOps”, you say yes, and three months later you are an expensive spreadsheet janitor because nobody defined the deal. The fix is to write the contract yourself before the statement of work hardens. SecOps, in the sense that actually functions, is an agreement between security and operations — baselines, one owned queue, dated fixes, expiring exceptions, shared numbers — and an independent contractor is often the only person in the room with the standing to propose it. Here are the eight clauses I now get into writing before any hardening work starts, plus the one thing I refuse to sign.

Why SecOps Freelancers Get Invited Back

The clients who rehire are not the ones with the flashiest scan reports. They are the ones whose findings stop piling up. That outcome depends entirely on the deal structure, because the underlying problem is never technical: it is that security discovers, operations fixes, and nobody has signed for the join between them. Get the clauses below into the engagement and you become the person who made the two sides legible to each other. Skip them and you inherit every pre-existing argument about priority, blame and whose weekend the patch window ruins. A practical note on sizing, too: for estates up to roughly five hundred assets, this contract model works without hiring anyone full-time — past that, a weighted comparison of options scored an embedded champion arrangement 25 against 17 for a merged team, which is the kind of number worth quoting when a client asks whether they should restructure instead.

The Eight SecOps Clauses Worth Writing Down

1. One queue, one owner each. All findings from all tools land in a single register, and every entry carries a named owning team. A finding that cannot be routed is logged as an asset-register defect, not parked.
2. Dated fixes, proportionate by cell. Deadlines are set per combination of asset importance and urgency, not one flat SLA. Internet-facing and critical gets a different clock than an internal test box, and the clocks are agreed before the first scan runs.
3. Baselines from published sources. Name the benchmark per platform, tailor it with a written file, and record the edition. Checklists drift — publishers and automation projects release at different speeds — so the version goes in the document, not in folklore.
4. Log-only before enforce, always. New policies run in log-only mode or on a pilot ring with a cooling-off stretch; enforcement widens ring by ring. This clause has saved more client weekends than every other line combined.
5. Exceptions expire. Each one has an owner, a written reason, a reviewer and a renewal date. The register reports how many are past review, and that count trends toward zero or the reasons get aired.
6. A telemetry floor owed to monitoring. Spell out the CIS Control 8 duties: at IG1, controls 8.1 through 8.3 covering how logging happens, what gets recorded and where records live; at IG2, clock discipline (8.4), pulling logs to one place (8.9), keeping them ninety days (8.10) and weekly review duty (8.11).
7. Privileged plumbing named and guarded. Scanners, root and SYSTEM agents, and orchestration tokens get domain-admin treatment: listed holders, break-glass steps, second-person review on routing-rule edits, because whoever edits routing can quietly bury findings.
8. Shared metrics, honestly grouped. Grouped on-time rates by importance-and-urgency cell, how long fixes actually take at the middle and the ninetieth percentile, and a weekly count of findings nobody owns. Never reward closed-ticket volume — that metric gets gamed by noon on day one.

A SecOps Scorecard You Can Hand the Client on Day 30

Clause eight earns its keep the first time you present numbers. Take a September scorecard from a mid-size estate: 240 findings were due, 198 closed on time, which sounds like a respectable 82.5% until you split it by cell. Internet-facing critical assets ran at 95% while datacentre critical assets managed 75%, and the gap traced to a single owner group with no agreed change window. Alongside the headline sit the health checks that keep it honest.

• Unowned findings: 18 of 600 — three percent, each with a chase date after this meeting.
• Exceptions past review: 6 of 35 — the register forced the conversation, which is its purpose.
• Telemetry coverage: 1,540 of 1,600 hosts reporting; the missing 60 sat in a freshly acquired subsidiary nobody had onboarded.
• Disruption from security changes: 3 of 120, all caused by one estate-wide baseline pushed with no pilot ring.

Hand that page over and the room stops debating whether security is “on track” and starts debating specific teams and dates. That is the clause doing its job.

SecOps Clause Zero: What I Refuse to Sign

Three refusals keep engagements sane. I will not accept “the monitoring centre will catch it” as a risk treatment — detection is not remediation, and the SOC’s existence is not a patching plan. I will not price work where success is defined as installing an update cleanly; the Netlogon episode taught the industry that an update can install without incident and still be months from enforced. And I will not take on a “merge the teams” project as a prerequisite, because merging is not required — the contract alone does the job, and org surgery is a fine way to burn a quarter.

Pricing the SecOps Engagement Honestly

Clause-based deals price better, which surprises people. When the deliverable is a register that empties on schedule, you can scope to milestones: baseline catalogue in month one, log-only rollout in month two, first grouped scorecard in month three. Compare that with hourly ambiguity and the case writes itself. The commercial rhythm around this kind of work is worth studying — this blueprint for a profitable freelancing routine covers the pipeline side, while this look at where SRE freelancing is heading shows why reliability-adjacent skills keep widening the client base. For credentials that reassure procurement teams, the SRE Foundation certification manual pairs well with the definition of SecOps that the Ops Atlas publishes, which is the reference I attach to every proposal.

None of the eight clauses is exotic. They are one page of plain language that converts a vague request into a deliverable with owners, dates and numbers. Write them in before the first invoice, and the engagement stops depending on goodwill — it runs on the document, which is exactly what you want when you are the most transient person in the client’s Slack.