# Kelsey Waters

Kelsey Waters works on Openlane, a platform that helps growing companies build security and compliance programs around their needs. Their posts discuss helping founders decide when to start compliance work and building customer and partner relationships.

- Profile: https://b2binfluencer.marketing/creators/kelsey-waters/
- LinkedIn: https://www.linkedin.com/in/kelsey-waters
- LinkedIn followers: 2,935
- Topics: sales, startup
- Based on 9 dated posts, latest 2026-10-08

## Summary

Kelsey Waters is most useful for founder-facing content on when to start compliance work.

- Best for: A content or advisory collaboration for early-stage and growth-stage software founders considering compliance.
- Not for: Campaigns needing proven reach or paid formats, and hard-sell pushes to not-ready founders.
- Check first: Confirm recent post performance, audience data, and partnership terms, as no paid format is published.

### Takeaways

- Start compliance when a business signal makes it worth doing, not before.
- Build the compliance program around the company you actually have, not a template.
- Openlane moved from beta to live audits and shared onboarding and audit stories.

## Main ideas

- **Start compliance when a business signal makes it worth doing, not before**: Waters argues that early-stage founders should not take on compliance just because the requirement is somewhere on the horizon. They describe founders trying to build smartly, affordably and securely, and say it often does not make sense to start until a clear signal appears. They name three: readiness to move into enterprise sales, preparing for a large enterprise proof of concept, or signing a significant deal that carries a compliance requirement. A founder may hear "SOC 2" a month or a year before they are ready for a platform. The useful work, Waters says, is helping founders understand what to do in the meantime so they are in a good position when the requirement becomes real.
- **Build the compliance program around the company you actually have**: Waters says growing companies do not want a compliance program built from someone else's template. They connect that observation to how Openlane is built, presenting flexibility to create a security and compliance program that reflects how a company operates as the shared value. The post presents Anchorpoint's founder-led model as the services-side proof and names Joe Munsayac and Austin as the firm's principals.
- **Advice before the sale is part of how compliance gets bought**: Waters says they knew that building in compliance and trust with earlier-stage companies meant longer sales cycles, but did not expect to spend so much time helping founders decide whether to take compliance on at all. Rather than push an immediate purchase, they explain what a founder should be doing now. The approach stretches the sales cycle, with the payoff of a founder positioned to act when the requirement becomes concrete rather than a faster close.
- **Growth comes through relationships, partners and the local founder community**: Waters measures progress through relationships rather than metrics. A June conversation with Joe Munsayac about a shared observation became a formal place in the Openlane partner network. The relationship centers on supporting mutual clients and a shared view of how compliance work should be done, not referral mechanics or pricing. The same pattern runs through their community presence: panel appearances, customer meetings, partner conversations and introductions across the San Antonio founder network.
- **Openlane's own compliance and launch work is treated as public material**: Across the posts, Waters points to Openlane's own work as an example: pushing a beta live, rebuilding the user experience from feedback, changing onboarding, sharing customer audit stories and finalizing evidence requests for the company's own SOC 2 audit while taking customer and partner meetings. The company also describes its own compliance work in public.

## Work to read

- [A year of Openlane: from beta to live audits](https://www.linkedin.com/posts/kelsey-waters_its-been-a-year-since-my-first-san-antonio-activity-7513951616199434240-uyag)
- [Partnering with Anchorpoint: compliance built around the company you have](https://www.linkedin.com/posts/kelsey-waters_back-in-june-joe-munsayac-and-i-connected-activity-7508180096457838592-455J)
- [When founders should start compliance work](https://www.linkedin.com/posts/kelsey-waters_i-knew-building-in-compliance-and-trust-and-activity-7510737144974307328-cUvL)

## Brand relationships

- **Openlane** (disclosed_partnership)
- **Anchorpoint Partners** (disclosed_partnership)

## Partnerships

No sponsorship, advertising, or paid-content format appears in the posts, and no official route for brand partnership inquiries is published. The partnership activity runs the other way: Openlane is building a network of compliance and security firms. The documented example is Anchorpoint Partners, a boutique, founder-led cybersecurity and compliance firm that joined the Openlane partner network after a June conversation between Kelsey Waters and Joe Munsayac. Anchorpoint builds programs around each client’s business rather than a standard playbook, and supports SOC 2, ISO 27001, ISO 42001, HIPAA, CMMC, and HITRUST work, along with vCISO and compliance-readiness services. A separate post describes introducing a fellow founder and offering to make an investor connection at an Alamo Ventures event—relationship building, not a purchasable format. For a B2B SaaS compliance platform weighing a content collaboration, there is no published package, deliverable list, or rate, so scope, format, and terms would need to be defined in conversation. The partnership language describes how Openlane works with service firms to serve mutual clients, not how Waters works with sponsors; the Anchorpoint announcement is not an available sponsored-content offer. The same pattern appears in the October post about San Antonio Startup Week, where conversations about supporting mutual clients sit alongside customer meetings and the company’s own SOC 2 audit preparation. Partner work appears to happen through direct conversations rather than a published program. To assess a potential collaboration, ask about sponsorship terms, available formats, and how to submit a partnership inquiry.

## Alternatives

- Thomas Ward: Choose Thomas Ward when the platform wants a compliance advisor whose public voice already speaks to buyers with a defined regulatory trigger, rather than founders still deciding whether compliance is worth starting. The July 14 post handles the Department of Defense pause of CMMC Phase II by answering the questions a contractor actually asks — whether to stop preparing, cancel an assessment, or treat NIST 800-171 as optional — and then lists what to keep doing: implement and mature NIST SP 800-171 controls, remediate gaps, write policies that hold up day to day, and prepare for future assessments. It closes with a direct offer of a complimentary one-hour strategy call and a service list covering gap assessments, System Security Plans, PO&AMs, and fractional CISO work. For a platform selling into the defense industrial base, that is a shorter path to a qualified conversation than a founder-readiness narrative, because the reader arrives already carrying a contractual requirement. The October 5 post shows a second register: taking on the Interim Executive Director role at the Center for Creative Living and writing honestly about how business skills translate into nonprofit work and how the definition of success changes. That range is useful if a campaign needs a named advisor who can speak about leadership and risk beyond a framework checklist.
- Jacob Riff: Choose Jacob Riff when the platform's hardest objection is the one its own prospects make: that a tool is not necessary. The August 20 post walks a small team through what a SOC 2 audit actually involves — adding vendors and doing due diligence on each, writing roughly 20 policies and making them match how the company works, implementing about 100 to 150 controls, evaluating risk, deciding on a penetration test, and understanding that a Type I covers a single day while a Type II runs a three-to-six month observation period and repeats every 12 months. It also notes that an engagement letter can keep a blocked deal moving while the work happens. The August 6 post takes the objection head-on, quoting someone who called the work a waste of money, agreeing that a spreadsheet and a shared drive can get a company to an attestation, and then explaining what does not get counted: the hundred small tasks, the evidence collection and updating, and the risk of everything living in one person's head. It ends by naming who the product was built for — the founder working at night after the kid is asleep. For a platform, that combination of operational detail and willingness to argue against itself is unusually strong material to co-produce against.
- Mikaela Rivera, CPC: Choose Mikaela Rivera when the collaboration needs to reach the person inside the buying company who will carry the readiness work rather than the founder signing off on it. The May 29 post argues that success leaves clues and that high performers are identifiable by patterns — clear, responsive, and proactive communication, not leaving people guessing, responding with urgency, following through, and saying so when they do not have an answer — and turns that into advice for job seekers on how they show up in the rooms they want to be in. The June 12 post describes the work itself: five days in the gym, packed days connecting with candidates and talking through opportunities, no two conversations alike, sometimes getting creative to make the pieces fit. For a platform whose adoption depends on an operations, HR, or security lead driving the project internally, that is a different and complementary audience to a founder-facing compliance message, and it speaks to how readiness work gets staffed.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/