Most firms don't need a full-time CIO. They need one occasionally.
North Rain Technologies designs, builds and secures the systems professional firms run on — architecture, identity, networks, migration and AI adoption for organizations that have outgrown improvised IT but have no reason to staff a department for it.
Where we're brought in
Five things account for nearly all of it. Open any one for the detail.
-
Most firms arrive here the same way: OneDrive folder sharing worked fine at four people and quietly stopped working at twelve. Nobody is sure who can see what, and finding last year's file takes three guesses.
The work is a proper site architecture, a permission model that reflects how the firm is actually structured, secure guest access for clients who need visibility, and a migration that preserves metadata rather than flattening everything into a new folder tree. Staff keep working out of Windows Explorer and mostly don't notice the change.
-
Conditional access policies, multi-factor rollout that staff will tolerate, device compliance, and governance over who outside the organization can reach what.
There is also usually money on the table. Firms routinely pay for standalone antivirus and backup tools that duplicate what their Microsoft 365 licensing already includes. Part of this work is finding that overlap and saying honestly whether consolidating is worth it, which sometimes it isn't.
-
AI rollouts rarely fail at the AI. They fail at the data layer, because an assistant inherits its user's permissions and will cheerfully surface the payroll spreadsheet somebody dropped in a shared folder in 2019.
Getting the permission model right before you point an assistant at your files isn't preparation for the project. It is most of the project. The rest is pilot scoping, rollout, and training people on what the thing is actually good at.
-
Vendor selection, roadmap, budget sanity checks, and reading the managed-services contract properly before anyone signs it.
This is the work most firms can't justify hiring for. You need an experienced technologist perhaps four times a year, at exactly the moments when a bad decision gets expensive, and a full-time salary makes no sense for that.
-
Performance auditing, rebuilds on modern edge infrastructure, analytics that answer a question somebody actually asked, and accessibility work that keeps you on the right side of it.
One Tuesday, both ways
Fifteen hours on a single clock, scored. Scrub to any hour — or switch sides mid-scene. The time of day never changes, only whose day it is.
One view, not six logins
Tenants, endpoints, identity, licences, backups and spend normally sit in six consoles and three inboxes, and nobody reads any of them. We consolidate the lot into something you can take in at a glance. Clear the weather and see for yourself.
Drag to clear
- One console instead of six tabs and a spreadsheet.
- One alert queue, triaged before it reaches you.
- One monthly number you can hand to your board.
Security and infrastructure,
at whatever size you are
The same discipline applies to a ten-person office and a multi-site network. What changes is how much of it there is. Pick a scale.
Ten to thirty people, one office or none at all, everything riding on Microsoft 365 and a consumer-grade router nobody has logged into since it was installed.
- Business-grade firewall and segregated guest Wi-Fi
- MFA and conditional access across every account
- Managed endpoints with disk encryption and patching
- Backup that has actually been restored from, at least once
- A written record of what exists and who can reach it
Thirty to two hundred people, more than one location, a server or two that still matter, and a compliance obligation somebody has started asking about.
- VLAN segmentation and policy-driven routing between sites
- Site-to-site VPN or SD-WAN with real failover
- Entra ID hybrid join, SSO, and privileged access tiers
- Centralized logging with alerting somebody reads
- Documented incident response, tested rather than filed
- Vulnerability scanning on a schedule, with remediation tracked
Multi-site, multi-tenant, regulated, or all three. Change control matters more than speed and an outage has a dollar figure attached to it.
- Redundant core with no single point of failure
- Zero-trust access model and microsegmentation
- SIEM pipeline, retention policy, and defined escalation paths
- Conditional access tied to device posture and risk signals
- DR runbooks with tested recovery objectives, not aspirational ones
- Audit evidence produced as a by-product of operating, not a scramble
A thousand seats across a dozen sites, a real security function, and auditors who want evidence rather than assurances. At this size nothing is done by hand twice, and every change has a paper trail.
- SD-WAN between sites with policy enforced centrally, not per-branch
- Privileged access management — standing admin rights removed, elevation time-boxed and recorded
- A SOC watching the SIEM around the clock, with escalation paths that name people
- Identity governance: joiner/mover/leaver automated end to end, access recertified on schedule
- Tenant-to-tenant migrations after acquisition, without a freeze on the business
- Change advisory that takes hours rather than weeks, because the evidence is already there
Ten thousand seats and up, across regions and regulatory regimes. The architecture question stops being what to build and becomes what to standardise, what to federate, and what to let each region own.
- Multi-region design with an active DR posture, tested against stated recovery objectives
- Edge and WAF in front of everything public, with traffic policy as code
- Federated identity across tenants and acquisitions, one set of rules, local control where law requires it
- Data residency and retention mapped per jurisdiction, enforced by policy rather than memo
- Platform engineering: the standard build published, consumed self-service, drift reported
- Board-level reporting on risk, spend and posture, produced from the same data the engineers use
What we work in
Platforms and products in regular use. Not a list of everything we've touched once.
Microsoft 365 & Azure
- SharePoint Online
- Exchange Online
- Teams
- OneDrive
- Entra ID
- Intune
- Purview
- Defender
- Power Automate
- Copilot
- Azure AD Connect
- Azure Virtual Desktop
Security
- Conditional Access
- MFA
- Zero trust
- SIEM
- Endpoint detection
- Email security
- Vulnerability management
- Backup & DR
- Penetration test remediation
- Security awareness training
Networking
- Firewalls
- VLAN design
- SD-WAN
- Site-to-site VPN
- Enterprise Wi-Fi
- Layer 3 switching
- BGP & OSPF
- QoS
- Network monitoring
- Structured cabling
Infrastructure & cloud
- Virtualization
- Windows Server
- Linux
- Active Directory
- Storage & SAN
- Cloudflare
- Edge compute
- DNS architecture
Business systems
- Document management
- Identity governance
- Workflow automation
- Monday.com
- Planner
- Migration tooling
- Licensing optimization
Work that runs itself
Four jobs every professional firm does by hand. Here is what each looks like once it's wired across the SaaS layer — and the prompt that does the thinking part.
The hours nobody bills for
Onboarding, offboarding, licence true-ups, access reviews, patch verification, backup checks, the monthly report somebody rebuilds by hand. None of it is hard. All of it is constant. Here is what it costs, and what it costs once it runs itself.
- Joiner, mover, leaver — account, licence, groups, device and mailbox handled from one approval instead of nine clicks in four consoles.
- Licence true-ups — sign-in data reviewed monthly, unused seats flagged before the renewal, not after it.
- Access reviews — evidence collected on a schedule, so an audit is a download rather than a fortnight.
- Patch and backup verification — checked, restore-tested and reported without anyone remembering to look.
What a project actually looks like
A tenant migration for a thirty-person firm, mapped across fifteen working days. Hover a phase for what happens in it.
Phases overlap because migration prep starts while the architecture is still being built. Most of weeks two and three run in the background without touching your staff.
When hiring is cheaper, we’ll tell you
An employee beats us on hourly rate the moment you can keep them busy. The question is whether you can — and which employee you’d actually need to do this work. Pick a scope, then pick who you’d otherwise be hiring.
Start from a real engagement
Or set your own number below.
A firm of 10–30 people with no major project running typically lands between 100 and 300.
Who you’d otherwise hire
- Our rate
- $150/hr, billed in 30-minute increments, no retainer
- In-house base
- $175,000 — infrastructure & security lead, Vancouver
- Employer burden
- +25% for CPP, EI, employer health tax, benefits, equipment and training
- Crossover
- 1,458 hours a year
Base salaries: Salary.com benchmarks for Vancouver, BC, September 2026 — enterprise infrastructure manager median C$175,323, chief technology officer median C$360,056; IT manager from PayScale. Statutory employer contributions in Canada run roughly 5.8% before benefits; the 25% here adds vacation, health coverage, hardware and training. Your numbers will differ — these are a starting point, not a quote.
A recent engagement
A fully remote accounting practice, multiple staff, a growing client base, and every file living in personal OneDrive shares.
- Files migrated
- 207,000
- Data moved
- 135 GB
- Start to handover
- Under 3 weeks
The firm had grown past what folder sharing can carry. Staff could reach things they shouldn't, clients had no clean way to exchange documents, and there was no structure that would hold another year of growth.
We built a SharePoint environment around how the practice actually works — a client library with per-client folders and inheritance broken where it needed to be, separate internal libraries for admin and AR/AP, and a permission model mapped to roles rather than individuals. Guest access was configured so clients authenticate with their own Microsoft accounts and see only their own material.
Then the migration: validating paths and naming conventions, mapping libraries into batches, identifying the files that were going to break before they broke, and moving everything with metadata intact. Conditional access and MFA went in behind it. Staff kept working through Explorer the entire time.
The firm finished with an architecture summary, a permissions map and a migration record, all of it theirs to keep and hand to whoever comes next.
How we work
No retainer
Billed hourly with a thirty-minute minimum per incident. You pay for work, not for availability. If you don't need us for two months, that costs nothing.
Senior lead, start to finish
The person who scopes your project runs it. Nothing gets scoped by one team and quietly handed to another once the contract is signed.
Specialists on demand
A deep bench of vetted specialists we bring in by name when a project needs one, so you get the right expertise without carrying it on a payroll between engagements.
Documentation at handover
Architecture summary, permission map, migration record. Written so your next person can read it. Being hard to replace is not a business model we're interested in.
Response that means something
Same business day for anything genuinely critical, next business day for everything else. Stated plainly so you can hold us to it.
Scoped before it starts
A written estimate with hours against each workstream before any work begins. Scope changes get re-quoted rather than absorbed quietly into the invoice.
Tell us what's broken,
or what you're planning.
Either is a good reason to get in touch. A short conversation is usually enough to tell whether we're the right fit, and we'll say so if we're not.
hello@northrain.ca