Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
locations · san jose

Chip designs and source code are the crown jewels, and contractors touch both every day.

South Bay employers hand design files, firmware and test data to foundries, EDA vendors and contract engineers every week. The question we hear most in San Jose is easy to ask and hard to answer. Which outside accounts can still reach the design repository today?

Talk to an engineer
work in san jose6 services
2 local rules covered below
in short·15-second read

Our San Jose work centers on semiconductor, networking hardware and enterprise software companies.

We lock down privileged access to engineering and lab environments, govern accounts held by foundry partners and contractors, and classify design data so loss-prevention rules fire on the right files. We also cover California privacy duties for customer data. Cohash serves San Jose remotely from Frisco, Texas and visits for workshops and launches.

We don't have a San Jose office. Cohash is headquartered in Frisco, Texas, works with Silicon Valley teams remotely, and travels to the South Bay for design sessions, lab walkthroughs and cutovers.

Ask an engineer facts checked 2026-10-21 · 8 sources
rules
Cal. Civil Code §1798.82, business breach noticeCCPA cybersecurity audit and risk assessment rules
background
Every entitlement translated into business terms Auto-certified by policy unchanged and peer-aligned Ranked exceptions SoD conflicts first Revoke and verify proof logged with the decision
field note · 5 minThe access review nobody dreads
san jose by the numbers

What's specific about San Jose

Each figure comes from a public source, linked on the card.

01 1,178

Manufacturing accounts for about 131.1 thousand and professional and business services for 277.6 thousand of the 1,178.2 thousand nonfarm jobs in the San Jose-Sunnyvale-Santa Clara metro, per BLS for September 2026 (preliminary).

source ↗ 02 $92 billion

Silicon Valley companies drew $92 billion in venture capital last year, about $80 billion of it going to AI firms, Joint Venture Silicon Valley said when it released its 2026 Silicon Valley Index on February 24, 2026.

source ↗ 03 215,000

The same 2026 Index counts 215,000 workers at the region's 20 biggest tech firms, about 9% of the workforce, and more than 23,000 new patents last year.

source ↗ 04 12 million

San Jose Mineta International Airport, which the city owns, describes itself as a gateway for nearly 12 million annual passengers, with nonstop service to more than 40 destinations.

source ↗
who and what

Who we work with in San Jose, and the rules they work under

industries

  1. Semiconductor design and EDA

    Design teams share repositories and EDA licenses with foundry, IP and verification partners. We separate partner identities from employee ones, require device posture checks for access to tape-out data, and set data loss rules on GDS and RTL files so a bulk export to a personal cloud drive raises an alert.

  2. Networking and hardware labs

    Lab gear and test benches often run local admin accounts that never touch the corporate directory. We discover those accounts, vault the passwords and route engineer access through a PAM jump host with recorded sessions, which also gives trade compliance reviewers a clear record of who reached what.

  3. Enterprise SaaS vendors

    Software companies selling to large enterprises face security questionnaires on SSO, SCIM provisioning and customer-managed keys. We build tenant-level SSO and SCIM into the product, tighten internal production access and pull together the evidence a buyer's procurement team asks for.

regulations

  1. Cal. Civil Code §1798.82, business breach notice ↗

    Businesses holding Californians' unencrypted personal information notify affected residents within 30 calendar days of discovering a breach, a deadline SB 446 added for 2026. Sending notices to more than 500 residents means a sample copy goes to the Attorney General within 15 days.

  2. CCPA cybersecurity audit and risk assessment rules ↗

    CCPA-covered businesses that meet the regulations' risk thresholds must complete annual cybersecurity audits. Certification is due 1 April 2028 for revenue over $100 million, 1 April 2029 for $50 to $100 million, and 1 April 2030 below that. Risk assessments started 1 January 2026.

services

Most requested in San Jose

The services clients in San Jose ask us for most.

you are hereSan Jose
01Can a foundry partner get access to one project without seeing the rest of the repository?

Yes. We create a separate partner identity tier, federated from the partner's own directory where possible, and grant it to one project space with download limits and watermarking on sensitive files. Access ends with the project milestone unless an owner renews it.

02Our lab has hundreds of devices with shared admin passwords. Where do we start?

With discovery. We scan lab subnets and configuration backups for local accounts, rank devices by what they connect to, and vault the highest-risk credentials first. Engineers then check out passwords or use brokered sessions, and rotation happens after each use.

03Are we in scope for the CCPA cybersecurity audit?

Only if you are a CCPA business and meet the risk thresholds in the regulations, which turn on revenue and the volume of personal or sensitive information you process. A hardware company selling mostly to enterprises may handle little consumer data. Your privacy counsel makes the call, and we can map data flows to support it.

04Do you work on export-controlled technical data?

We design the access controls and logging that keep controlled technical data with authorized people, including nationality-based access groups when your trade compliance team requires them. Classification and licensing decisions stay with your export compliance staff and counsel.

california

More cities in California

All 82 cities
Irvine, Orange CountyMedical devices & health care Los AngelesStudios, ports & Medi-Cal SacramentoState government & public pensions San DiegoNavy, defense tech & genomics San FranciscoAI labs, fintech & banking
sources 8 sources linked last checked 2026-10-21 content fingerprint 94c708fb
  1. 01BLS, San Jose-Sunnyvale-Santa Clara economy at a glancebls.gov ↗
  2. 02Joint Venture Silicon Valley, 2026 Silicon Valley Index releasejointventure.org ↗
  3. 03San Jose Mineta International Airport, about SJCflysanjose.com ↗
  4. 04California Civil Code §1798.82leginfo.legislature.ca.gov ↗
  5. 05California Attorney General, data breach reportingoag.ca.gov ↗
  6. 06Pillsbury, California SB 446 breach notification changespillsburylaw.com ↗
  7. 07California Privacy Protection Agency, regulationscppa.ca.gov ↗
  8. 08Hunton, staggered compliance dates for the 2026 CCPA regulationshunton.com ↗
Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it