Just so we're clear: I'm saying my personal experience extends only as far as a single org of NCC's size, and then a variety of boutique-y firms of ~Matasano's size. I have no experience with Deloitte or PwC. I'm not calling your friend's firm a boutique; it's clearly not.