Sean JohnsTaking two new retainers for Q4 2026IT direction for companies of 80 to 600 people. Two days a month, from someone who has run it at 1,200.
You’ve outgrown the developer who does IT, and you’re not ready to pay a full-time head of IT with equity. I take the seat on your org chart: identity, devices, the software bill, security readiness, onboarding, and hiring the person who eventually replaces me.
Barcelona on site · Spain and UK remote · English and Spanish
An enterprise customer sent 140 security questions and nobody in the building can answer them with evidence.
The first two weeksI answer it from your admin consoles, mark what's true today, and price exactly what closes each gap. The deal doesn't wait on IT.
Illustrative scorecard. Yours gets scored on what your admin consoles actually show, not a survey.
SaaS spend removed in one quarter at a listed scale-up
Endpoints at 99% availability across global sites
A global service desk built from nothing: Barcelona, Riyadh, Shanghai, Oslo
Downtime moving a 50-person studio in peak season
The job description you would write, if you had written one before.
I read seventeen scale-up Head of IT postings from 2026. They ask for the same seven things, in roughly this order. Here’s the list, in their words.
Single sign-on, MFA everywhere, least privilege, automated joiners, movers and leavers. Okta or Entra, with provisioning that does not depend on a person remembering.
Jamf, Kandji or Intune; encrypted, patched, monitored, wiped when lost. Zero-touch enrolment so a laptop is ready before the hire starts.
Every subscription has an owner, a renewal date and a seat count someone checks. The savings come from what nobody was using.
SOC 2 or ISO 27001 because an enterprise customer asked; questionnaires answered honestly; the auditor coordinated by the person who owns the controls.
SLAs, runbooks, a queue, cover when they are off.
Networks, domains, backups that have been restored on purpose, no single point of failure a leaver can trigger.
Which tools, which data, what it costs, who is trained. The newest line on every posting, and the one nobody owns yet. See the AI section →
Whatever the title on your org chart says, this is the work. The diagnostic scores your company on all seven.
Four steps. The first is fixed price and you keep the result.
I don’t sell a retainer before a diagnostic, or a diagnostic before a thirty-minute call about what triggered it. Usually an enterprise customer’s security questionnaire, a hiring wave, an office move, an acquisition, a cyber-insurance renewal, or an AI rollout nobody owns.
Diagnostic · 2 to 3 weeks.
A named admin account in your systems, exports not opinions, eight short interviews. You get a scorecard on the seven domains, the ten fixes ranked by risk removed per euro, a twelve-month roadmap and a budget your board can read.
Foundation · 90 days.
For companies with no IT function yet. One day a week to stand it up: identity, devices, the software register, the help desk, the security baseline. Ends with your first IT lead hired, or a retainer, your choice.
Retainer · 2 or 4 days a month.
The IT director on your org chart. One day on site. A weekly thirty minutes with your sponsor. A one-page monthly report: seven traffic lights, decisions you need to make, renewals in the next ninety days, risks, and a log of everything my admin account did.
Handover · when you are ready.
I write the role, run the interviews and hand over for three months. A fractional director who leaves well is how the next client finds me.
If a full-time head of IT is the right answer for you today, I’ll say so on the call and you’ll have lost thirty minutes.
AI, with the guardrails.
Most fractional IT directors can’t say this part. Four things I do, inside the retainer or as fixed-price projects.
Enterprise AI rollout, done properly.
Claude or Copilot for the whole company: identity-locked to managed accounts, packaged and updated through your device management, data policy written, usage and cost visible. Delivered at a multinational in 2026.
Own the AI tool portfolio.
Evaluation, licensing, usage monitoring, cost governance, acceptable use. The line that has appeared on Head of IT postings this year, and the one nobody inside the company owns.
AI literacy that satisfies the law.
Article 4 of the EU AI Act has required staff AI literacy since February 2025. A ninety-minute live session per team, an assessment, verifiable certificates and an attendance register an inspector or insurer will accept.
Agents with a human gate.
When you start running agents on email, documents or payments: every consequential action held until a named person signs, three tiers, a signed audit log, refusals that become rules. Run on my own company first.
Send Q3 renewal summary to 412 customer contacts
Nothing leaves until a named person signs. Every refusal becomes a rule.
[SEAN'S WORDS. Facts to voice: 18 scheduled agent jobs, an approval queue and cost caps on his own company; 3,153 of the last 3,156 runs clean; ten failures written up with root causes.]
No autonomous sending. No AI in hiring or credit decisions. No vendor lock-in — Claude, OpenAI or Microsoft, whichever you already pay for.
Not a managed service provider. No help desk. If you have nobody, the first project is getting you someone.
Not a reseller. No commission from any vendor I recommend. The savings are yours.
Not for under 80 people. Below that the retainer is the wrong shape; a fixed-price project usually is not.
Not a deck. When it is faster to write the Intune policy, the Okta rule or the script myself, I write it.
Fees.
The diagnostic is credited in full against the first quarter of a retainer. Six-month minimum, then rolling quarterly. Projects are quoted fixed price from the roadmap. No vendor commissions.
Scorecard, ten fixes, roadmap, budget. Yours either way. (€7,500 over 120 people.)
For companies with no IT function yet. Ends with your IT lead hired or a retainer.
Roadmap, vendors and renewals, monthly report, escalation point for your sysadmin or MSP.
Everything above, plus ownership of a compliance track, hiring your first IT lead, and a quarterly board slide.
Acting head of IT through a change: a move, an acquisition, a listing, a rollout.
Fixed-price projects from the roadmap: identity and offboarding automation from €12,000 · device management rollout from €8,000 · SOC 2 / ISO 27001 readiness as the owner from €15,000 · enterprise AI rollout governance from €8,000 · SaaS spend review paid from savings · shadow-AI scan €1,500 · AI literacy from €600 per team · agent gate from €8,000 · hire-your-IT-lead €8,000.
Spain, excluding VAT. UK engagements quoted in GBP, roughly 15% higher. Professional indemnity and cyber insurance in place; data-processing addendum on request.
Twenty years, mostly in the seat.
Internal IT for fast-growing, distributed technology companies. I set the strategy, and I was usually the one implementing it.
Sean Johns · Barcelona. ISO 27001, SOC 2, GDPR and SOX maintained without a dedicated security team.
Endpoint and identity side of an enterprise Claude rollout.
€850K of SaaS spend removed in one quarter at a listed scale-up. Maintained ISO 27001.
Identity and endpoint operations through a hypergrowth year.
4,500+ endpoints at 99%+ availability across global sites. Budgets to €3.3M; teams of 19, 10, 8 and 8.
[ONE LINE — what you owned at Citibank]
[REFERENCE 1]
[NAME] · [TITLE] · [COMPANY]
[REFERENCE 2]
[NAME] · [TITLE] · [COMPANY]
[SEAN'S WORDS: three sentences on why two days a month is enough and what he refuses to do, from a voice note]
A named admin account in your identity provider, device management, ticketing, and a SaaS spend export from finance. The data-processing addendum is signed before any of it is granted, and everything my account does is logged and appears in the monthly report.
No. I'm not a help desk. I set the direction, hold vendors to their contracts, and give whoever does the hands-on work a roadmap instead of a queue. If you have nobody, the first project is getting you someone.
The diagnostic is scored on exports from your own admin consoles, not on a self-assessment. If a control isn't visible in the console, it doesn't score.
That's the goal. I write the role, run the interviews and hand over for three months. Retainers are a six-month minimum, then rolling quarterly, so nothing traps you.
On fixed-price projects, yes: a shadow-AI scan, a SaaS spend review, identity and offboarding automation. Below 80 the retainer is the wrong shape.
Barcelona, on site. Spain and the UK remote, in English and Spanish. Retainers include one on-site day a month; UK engagements are quoted in GBP.
Thirty minutes on what triggered the call.
Tell me who owns IT today, what your customers or auditors are asking for, and how many people you’ll be next year. If the diagnostic is the right next step, the statement of work goes out the same day.