Engineering governance into systems from day one. Focused on AI risk, compliance automation, and cloud-native security — moving GRC from spreadsheets to code.
I build pipelines that turn compliance from a quarterly spreadsheet exercise into a merge-blocking check: Terraform baselines that are compliant by default, policy-as-code gates that fail closed, signed evidence chains, and machine-readable control mappings an assessor can traverse without a meeting.
I'm certified on both sides of the audit: I build audit-defensible pipelines, and I assess someone else's.
Certifications
- Certified GRC Engineer – Auditor Specialty (CGE-AUD)
- Certified GRC Engineer – Practitioner (CGE-P)
- ISO/IEC 42001:2023 Lead Auditor — AI Management Systems
- ISO/IEC 27701:2025 Lead Auditor — Privacy Information Management
- ISO/IEC 27001:2022 Lead Auditor — Information Security Management
- CompTIA Security+ ce
- ServiceNow Certified System Administrator
- Microsoft Certified: Azure AI Fundamentals · Azure Fundamentals · Security, Compliance & Identity Fundamentals · Azure Data Fundamentals
Open to: GRC Engineer · AI Governance Engineer · Cloud Security / Compliance Engineer
Each repo is a stage of the same pipeline: compliant infrastructure → policy gates → signed evidence → continuous monitoring → machine-readable mapping.
Compliant IaC → Policy-as-Code Gate → Signed Evidence → Monitoring → OSCAL Mapping
- argus-ai-grc — AI Governance Compliance-as-Code engine. EU AI Act risk tiering, NIST AI RMF / ISO 42001 crosswalk, CI gate that blocks merges on critical findings. Live dashboard
- cgep-app-starter — CGE-P capstone: HIPAA-controlled Patient Intake API. Terraform baseline, 6 OPA policies with tests, signed CI evidence pipeline, OSCAL component mapping. Passed 81.7%.
- cgep-labs — Full lab portfolio: compliant modules, policy libraries, keyless OIDC/WIF pipelines, OSCAL authoring, across AWS and GCP.
- circleci-aws-opa-lab — CI/CD pipeline (CircleCI → AWS): keyless OIDC auth, Terraform deploy/destroy, OPA gates blocking non-compliant infra before it ships.
- cloud-encryption-evidence — Scans an AWS account and produces timestamped, audit-ready evidence that every S3 bucket, EBS volume, and KMS key is encrypted — mapped to SOC 2 / NIST 800-53 / ISO 27001 / PCI DSS / HIPAA.
- cloudtrail-logging-monitoring — Validates CloudTrail configuration against SOC 2 CC7.2 and NIST 800-53 AU-2/3/6/12, classifying trails by risk with remediation commands.
- aws_automated_access_review — Serverless IAM access review: Lambda + IAM Access Analyzer + Security Hub, summarized by Amazon Bedrock (Claude) and emailed on a schedule.
- AWS-IAM-Inactive-Key-Lifecycle-Manager — Detects inactive IAM access keys and automates their rotation/deactivation lifecycle.
- password-policy-automation — Automates enforcement and drift detection of IAM password policy against a compliance baseline.
- No-s3-Public-Buckets — OPA/Rego policy library denying any S3 bucket lacking full public-access blocking.
- apis-to-audit-ready-excel — Serverless pipeline extracting Security Hub findings into audit-ready Excel reports.
- Real-Time AI Incident Logging — a no-code Zapier pipeline that turns the public AI Incident Database into a live, severity-classified risk register with instant Slack alerts.
- Building an AI Readiness Tracker with Airtable — a beginner-friendly AI governance base: linked AI inventory, risk register, and controls tables with a compliance dashboard and automated alerts.
More on Medium.
| Category | Technologies |
|---|---|
| Cloud | AWS (S3, KMS, CloudTrail, Security Hub, IAM), Azure (AD, Policy, Defender for Cloud), GCP (WIF, Org Policy, Audit Logs) |
| Languages | Python (boto3), HCL, Bash |
| IaC | Terraform |
| Policy-as-Code | OPA/Rego, Conftest |
| CI/CD | GitHub Actions, CircleCI |
| Evidence & Signing | Cosign (keyless/Sigstore), S3 Object Lock |
| Machine-Readable Compliance | OSCAL, compliance-trestle |
| AI in the Loop | Amazon Bedrock (Claude) for automated findings summarization |
| Frameworks | NIST 800-53, HIPAA Security Rule, SOC 2, PCI DSS, EU AI Act, NIST AI RMF, ISO/IEC 42001/27001/27701 |
Claude Code · Cursor · n8n · OPA/Gatekeeper admission control · AI agent governance