GRC Engineering · Evidence Automation · IAM Governance · AWS Security Specialty
I design automated controls, evidence pipelines, and IAM governance systems for AWS environments — turning compliance from documentation into defensible engineering.
Three projects demonstrating the full stack — GRC engineering, detection, and Zero Trust architecture — with real outcomes against live AWS environments.
An engineering-driven approach to Governance, Risk, and Compliance on AWS. This framework interrogates AWS APIs directly — producing structured evidence, risk-scored findings, and audit-ready reporting across six major compliance frameworks simultaneously.
An event-driven detection pipeline that surfaces high-signal IAM anomalies in near real-time. Built with a QA engineer's approach to signal quality — systematic false positive tuning distinguishes legitimate activity from genuine risk.
A three-stack AWS serverless application built on Zero Trust design principles — every request authenticated, every resource encrypted, every action logged. Demonstrates the IAM and data protection controls validated by the GRC Engineering framework, deployed as production-ready infrastructure as code.
A security-first AWS reference architecture for retail workloads — demonstrating architect-level thinking across trust boundary separation, multi-account org design, and layered security controls. Grounded in real retail business context: customer identity, order workflows, payment-adjacent services, and prod/non-prod isolation.
Every project answers one question in a complete cloud security program. Together they form an integrated narrative — from architecture through detection, response, and governance.
Every repo answers one question in the security program. Together they form a complete cloud security governance narrative.
16 automated controls, risk scoring, framework mapping, immutable evidence vault. The anchor of the portfolio.
Event-driven pipeline targeting unauthorized AssumeRole activity. Production-grade false positive tuning. MITRE ATT&CK mapped.
Multi-account org design with trust boundary separation, centralized logging, layered ingress, and prod/non-prod isolation. Grounded in Genesco retail domain — customer identity, order workflows, payment-adjacent services.
Cognito JWT auth with DynamoDB access scoped to authenticated sub claim. BOLA/IDOR prevention, split Lambda execution roles, KMS encryption, CDK IaC.
JML lifecycle automation, stale access detection, privileged access review, cross-account trust analysis, leaver validation with three-way identity correlation, and quarterly access certification evidence.
Security Hub → Step Functions response workflows. Automated containment with approval gates. IR runbooks as code.
Config custom rules, SCPs, Checkov pre-commit hooks, OPA Terraform validation. Compliance shifted left.
Compliance score, risk register, framework heatmap. Ingests GRC framework output. Designed for CISO and audit committee audiences.
I am a cloud security professional transitioning from QA Automation Engineering and Linux Systems Administration into GRC Engineering and cloud security architecture.
My QA background gives me something most cloud security engineers don't have: I understand how to build systems that prove they work, not just claim they do. Test cases became detection rules. Root cause analysis became alert triage. Regression tracking became detection coverage mapping.
"I can design, secure, govern, detect, respond to, and automate compliance for AWS environments — and explain why each layer matters to the business."
Before cloud security, I spent years in security-critical retail infrastructure — automated testing of authentication flows, RBAC enforcement, payment processing, and multi-tenant data integrity across 1,000+ retail locations. That's where I learned how systems fail from the inside out.
Now I apply that discipline to GRC Engineering: building the automated controls, evidence pipelines, and governance systems that make compliance measurable and repeatable at scale. Based in Nashville, TN. Open to remote and hybrid roles.
Open to GRC Engineering, Cloud Security Engineer, IAM Engineer, and Security Automation roles. Nashville, TN — remote and hybrid considered.