We are a small company (< 20 ppl), have developed a fairly complex backend platform that exposes a web services API and we are currently productizing a SaaS-based offering that is a client to the backend. Both the backend and the SaaS-based offering are being marketed to enterprise prospects.
We adhere to security best practices but obviously we need independent verification and scrutiny if we are going to satisfy some of these large prospects. Eventually we will probably adopt some framework (COBIT, ISO 27001, etc.) once we can make some additional hires, segregate duties, etc. but for now we would like to improve our SDLC and submit our web applications to third-party penetration testing.
We have been trying to avoid the big accounting firms and big technology vendors (e.g. IBM) in the belief that they will be expensive and not in very good alignment with our organization. I guess I would call these "Tier I" consultants for lack of a better term.
We have tried what I'd guess I would call a "Tier II" firm (i.e. their personnel have come from a Tier I firm and provide similar services but are more affordable) but their experience seemed highly influenced by servicing companies seeking SOX compliance, etc. and the approach didn't seem like it was in good alignment with our need to prioritize our security expenditure.
I have tried to get in touch with other Tier II consultants but they seem to have their own issues (i.e. personnel leaving, don't get back to me in a timely fashion, don't really probe to see how they can best service our needs, etc.).
I am a bit reluctant to seek a sole proprietor or smallish company (call this Tier III I guess) as we want to leverage a name a little bit if we can and partner with someone that can provide some continuity of service and resources in a timely manner. No, "Sorry, I'm fully engaged right now, call me back in a month."
Which leads me to my conundrum/question: What kind of Security Consultant would you recommend for a small company that: 1) has a fairly complex web application; 2) markets its products and services towards enterprise prospects; and 3) needs to prioritize its security expenditure?
I should also state that I was trying to find someone with feet on the street in my neck of the woods so that we could meet face-to-face. I'm wondering how important a factor you think that is for this type of engagement.