Written before built
Any change to a control rule starts as a short written brief stating the regulation, the intent and the failure mode.
What it looks like
No rule ships without a brief on the record.
Working culture
A culture built for work that gets audited.
Culture at DeshCyber is an operating discipline: decisions are written before they are built, reviewed by someone who did not build them, and recorded so the reasoning survives staff changes.
We publish no team gallery, because a photograph proves nothing about a control. What we can show is how work moves through the company.
Six working principles
01Rules of practice that apply to research, engineering and assurance alike.
Reviewed by a second pair of eyes
Nothing reaches a client environment on one person's judgement, including urgent regulatory fixes.
What it looks like
Two named reviewers per rule: research and assurance.
One standard for every framework
SEC, PCI DSS, CMMC and SWIFT work is held to the same evidence bar, whatever the commercial pressure.
What it looks like
Same rule format, same review path, same export.
Named owners, narrow scope
Each framework and each control family has one accountable owner rather than a committee.
What it looks like
Ownership is published internally and rotates on review.
Quiet operations
Client incidents, findings and filings are handled without publicity, internally or externally.
What it looks like
Least-privilege access; no client names used as marketing.
Regulatory reading is the job
Time to read rule texts, assessor guidance and enforcement actions is planned work, not overtime.
What it looks like
Standing research time in every delivery cycle.
How a piece of work moves
02The same four steps whether the change is a new framework or a one-line rule fix.
- 01
Brief
The regulation, the intended verdict and the evidence required are stated in writing.
RecordDated brief with a named owner.
- 02
Build
The rule and its evidence collectors are implemented against test fixtures drawn from real filings.
RecordVersioned rule and fixture set.
- 03
Review
Assurance re-runs the rule independently and challenges the verdict before release.
RecordReview note with sign-off.
- 04
Record
The decision, its rationale and its effective date are filed where the next reader will find them.
RecordPermanent change record.
Working conditions, stated plainly
03The facts a candidate or a client usually asks about before anything else.
- Working model
- Remote-first, documented by default
- Working languages
- English and Bangla
- Progression
- By owned scope, not headcount
- Hiring standard
- Written exercise, reviewed blind
Decisions live in writing so time zones never gate a review.
Briefs, reviews and client exports are produced in both.
Seniority follows the control families and frameworks a person owns.
Candidates work a real rule brief; reviewers see the work before the name.
Go deeper on who we are
06The principles, people and engagement model behind the structure above.
Working this way produces one thing: evidence that holds.
See the beliefs the practice comes from, or the engagement model it produces for clients.