About
Aegis & Spear Cyber is a Maryland-based cybersecurity firm operated by one principal with two decades of building defensive and offensive cyber capability at scale, including standing up the first Defensive Cyber Operations unit in the Marine Corps Reserve.
Aegis & Spear Cyber is a Maryland-based cybersecurity firm that delivers offensive security testing, compliance audits, and strategic advisory engagements for organizations whose security posture has outgrown the internal capacity to evaluate it. The firm operates as a single-operator practice by design. Every engagement is run directly by the principal, every deliverable is written directly by the principal, and every client conversation runs through the same operator from scoping through debrief. There are no hand-offs to junior consultants.
Mauricio Maranho
I am the founder and principal of Aegis & Spear Cyber. The background that follows is personal history that informs how the firm operates. The work product is the firm’s; the service record is mine.
I have spent two decades building defensive and offensive cyber capability at scale. The Marine Corps Reserve has been the long thread through that career. I stood up the first Defensive Cyber Operations unit in the Marine Corps Reserve, and later stood up the first mission-sized Cyber Protection Team element at Marine Forces Cyberspace Command, also in the Marine Corps Reserve. Both were first-of-their-kind builds. The work was less about running an existing program than about assembling people, tradecraft, operating procedures, and the institutional case for capability that did not yet exist.
Outside the Reserve component, my civilian career has run in parallel across the same two decades. I have worked in defensive and offensive cyber operations, vulnerability research, red team operations, cloud security architecture, and systems engineering. Most often, the work required building or rebuilding capability rather than maintaining what was already in place. The through line is operator-side experience: more of my time has gone into building, defending, and breaking things than into reading about other people doing so.
Education and certifications
I hold an MS in Cybersecurity. Certifications currently held include the CISSP and OSCP, the GIAC credentials in penetration testing, web application security, mobile device security, and incident handling (GPEN, GWAPT, GMOB, GCIH), and the AWS Solutions Architect Associate and Azure Security Engineer Associate cloud certifications, among others. The certifications are listed for the prospects who ask. The differentiator is the work history above.
What this means for engagements
The background above informs how engagements actually run. Three points are worth making explicit.
First, the work is delivered by the same person who scoped it. There is no engagement model in which a partner sells the work, a senior consultant runs it, and a junior associate writes the report. The principal scopes, the principal executes, and the principal writes. The implication is fewer engagements running concurrently than a larger firm would carry, but better technical depth and consistency on each one. Engagements are scheduled accordingly.
Second, the deliverable is calibrated to the consumer who needs to act on it. The executive summary reads in plain English. The technical findings section reads at the depth a defender needs to remediate. The remediation guidance is sequenced by what produces security gain rather than by what produces a defensible-looking finding count. The standard is that a sysadmin should be able to act on the remediation without the tester present.
Third, the operating discipline is fixed-scope, fixed-fee, and time-boxed. Engagements are committed in writing before active work begins. Scope expansion requires a written change order rather than absorbed scope creep. The intent is clarity for the client: what they are paying for, what the deliverable contains, and when it lands.
The services page describes each engagement type in operational detail, and the approach page covers the engagement lifecycle that runs across all of them.
Talk to us
If you are considering an engagement or want to discuss whether one fits, reach out at contact@aegisandspear.com or through the contact page. Useful context in a first message: the question you are trying to answer, any regulatory or operational deadlines, and whether you have a specific engagement type in mind. Response within two business days.