40%
AT RISK
Before
Baseline of my own AWS lab account, before any controls were deployed.
Labs
More labs
The homepage shows three projects. Everything else is here: the full writeups, the posture scores by stage, proof links, experience, skills, and certifications.
About the work
I have 8+ years in IT and security, across IT operations, security operations, compliance, and vulnerability management in financial services, government, aerospace, and industrial environments. That includes a SOC analyst seat at Bank OZK, a bank that followed SOC 2, a state IT security role at the Arkansas Department of Public Safety, and project and consulting work at Legato Security, an MSSP. Before security, I spent 11 years at Arkansas Children's Hospital, including biomedical equipment work.
In my own AWS lab account I finished a ten-project compliance automation curriculum. The builds use Terraform, Python, boto3, OPA/Rego, GitHub Actions, Cosign, and OSCAL. I hold the Certified GRC Engineer, Auditor Specialty (CGE-AUD). The Practitioner course (CGE-P) is in progress, and so is ISO 27001 Lead Auditor.
The lab account measured 40% AT RISK before any controls were deployed. After the Terraform baseline it measured 78% NEEDS IMPROVEMENT. After the ten projects it measured 83% GOOD. Those are three stages of the same account. At the 78% stage the remaining gap was one intentionally misconfigured test bucket and a physical MFA device still pending setup on the lab IAM user. I documented that gap.
At Bank OZK I investigated phishing, malware, business email compromise, and DLP incidents, and tuned detection rules that cut phishing false positives by 40%. At Legato I led vulnerability and patch management for enterprise clients and cut critical remediation from several weeks to under 72 hours. At the Arkansas Department of Public Safety I kept patch compliance above 95% across 500+ endpoints and mapped controls to NIST 800-53 for state regulatory audits.
I have an M.S. in Cybersecurity from Maryville University and a B.S. in Information Technology from the University of Arkansas Grantham. The public build log for the lab work is on OracleRecon labs.
Compliance posture
One AWS lab account. Ten projects. Each score below is a stage of that account.
78%
NEEDS IMPROVEMENT
After the Terraform baseline
S3 encryption, public access blocks, CloudTrail, and required tags were in place. The remaining gap was one intentionally misconfigured test bucket and a physical MFA device still pending setup on the lab IAM user. I documented that gap.
83%
GOOD
After ten projects
The full curriculum was in the account: the CI/CD gate, Cosign signing, OSCAL documentation, and Okta identity controls, on top of the baseline.
- 10Projects built in my own AWS lab account
- 83% GOODAfter the ten-project curriculum
- 6/6Policy tests passing
- 21NIST 800-53 controls in the OSCAL SSP
Projects
Three flagship builds are first. The rest of the curriculum follows.
GRC Assurance EngineFlagship
A Flask app for vendor and AI tool risk reviews. The same inputs and the same rule-set version produce the same result. A person records the decision, and the event log keeps a SHA-256 hash chain so a later change to that record is visible. The live demo uses synthetic data only. It is an illustrative prototype. The results are not approvals, certifications, or a substitute for a formal risk process.
Auditor gets: a traceable record of every decision.
- Evidence-first vendor and AI tool risk review, with the person's decision kept separate from the score
- Explainable rules: the same inputs and the same rule-set version produce the same result
- Tamper-evident record of each saved decision, chained with SHA-256
- The public demo runs on synthetic data and says so on the page
GRC Engineering PipelineFlagship
An end-to-end, evidence-first GRC automation pipeline submitted to the GRC Engineering Club prize pool. It runs in my own AWS lab account. Terraform defines compliant AWS S3 storage implementing SC-28, AC-3, CM-6, and AU-3. Rego policies test the Terraform plan before deployment with 6 of 6 tests passing. GitHub Actions gates every pull request and blocks non-compliant merges at the platform level. Cosign provides keyless signing with a cryptographic chain of custody on the evidence artifacts. OSCAL maps every control claim to signed evidence, validated with trestle returning VALID on both documents. The published case study walks the same pipeline week by week, from the Terraform plan to the signed bundle.
Auditor gets: timestamped evidence on demand.
- 6 of 6 Rego policy tests passing across SC-28, AC-3, CM-6, and AU-3 controls
- Deliberate CM-6 tagging violation blocked at platform level by branch protection with preserved evidence artifact
- Tamper verification proves one appended byte breaks the cryptographic chain immediately
- Two OSCAL documents validated with trestle returning VALID on both
OSCAL System Security PlanFlagship
A machine-readable System Security Plan documenting 21 NIST 800-53 controls in OSCAL 1.2.1 format. Component definitions map each control to its implementation evidence and the signed artifacts that prove it. Validated with compliance-trestle returning VALID on both the component definition and profile documents. Written for environments where an assessor needs to check the plan from the file, including FedRAMP and federal reviews that ask for OSCAL.
Auditor gets: a plan that can be checked automatically.
- 21 NIST 800-53 controls documented in machine-readable OSCAL 1.2.1 format
- trestle validate returns VALID on both component definition and profile documents
- Control implementations mapped directly to Cosign-signed evidence artifacts
- Each control in the component definition points at the signed artifact that supports it
Compliance Automation Lab
A GRC engineering build in my own AWS lab account, following the AJ Yawn GRC Engineering for AWS curriculum. It started with four Python tools: control mapping across NIST 800-53, ISO 27001, and SOC 2, automatic risk scoring in a Flask web app, a compliance evidence collector that pulls audit artifacts from APIs, and an AI policy generator running through Ollama. Infrastructure work added a boto3 AWS Config compliance checker and a Terraform baseline. That baseline stage moved the lab account from 40% AT RISK to 78% NEEDS IMPROVEMENT. Security Hub CSPM followed with FSBP and CIS v1.2.0. GRC Engineering Club weekly challenges extended the lab: a GitHub Actions CI/CD gate that blocks non-compliant configs before merge, Cosign keyless signing with tamper verification on infrastructure artifacts, and a NIST 800-53 Rev 5 baseline deployed into Security Hub in the same lab account. After the ten projects, that account measured 83% GOOD.
- Terraform baseline moved my own AWS lab account from 40% AT RISK to 78% NEEDS IMPROVEMENT
- After the ten projects, the same lab account measured 83% GOOD
- GitHub Actions CI/CD gate blocks non-compliant infrastructure configs before merge
- Cosign keyless signing with tamper verification on infrastructure artifacts
- NIST 800-53 Rev 5 baseline deployed into AWS Security Hub in that lab account, alongside FSBP and CIS v1.2.0
SOC 2 Evidence Pipeline
A fully automated SOC 2 evidence collection pipeline built in my own AWS lab account. It pulls Security Hub findings and AWS Config compliance data using boto3, processes them through pandas, and generates a formatted Excel workbook with separate sheets for each Trust Services Criteria category. Designed to replace manual screenshot-based evidence collection with a repeatable, auditable, code-driven process.
- Pulls live Security Hub findings and Config compliance data automatically via boto3
- Generates formatted Excel workbook with sheets mapped to SOC 2 Trust Services Criteria
- Replaces manual screenshot-based evidence collection with a repeatable code-driven process
- Built without Audit Manager, which is unavailable in new AWS accounts
Event-Driven Compliance Engine
Auto-remediation in my own AWS lab account, on Lambda, EventBridge, and SNS, deployed entirely with Terraform. When AWS Config flags an S3 bucket as non-compliant for public read or write, EventBridge routes the event to a Lambda function that re-enables all four public access block settings and sends an SNS email confirming the fix.
- Detect-to-fix loop runs in about 3.5 seconds with no human intervention
- Remediation proven against a real non-compliant bucket, verified in CloudWatch logs and get-public-access-block output
- Least-privilege IAM role scoped to only the S3, CloudWatch Logs, and SNS actions the function needs
- Local test runner covers the remediate, compliant-skip, and unhandled-rule paths
CI/CD Compliance Pipeline
GitHub Actions pipeline that runs Bandit SAST on every commit and pipes findings directly into AWS Security Hub in my own lab account. Non-compliant code is blocked from merging via branch protection rules. Compliance evidence is generated automatically on every build, eliminating manual evidence collection for code security controls.
- Bandit SAST integrated into the CI/CD gate, blocking non-compliant code before merge
- Security Hub findings automatically imported on every pipeline run
- Compliance evidence generated as a build artifact on every commit
- Branch protection enforces the gate so developers cannot bypass the compliance check
Real-Time Compliance Dashboard
Flask web application with a SQLite backend and matplotlib visualizations that aggregates compliance findings from AWS Security Hub and Config into a live dashboard. Control status, failure trends, and remediation progress are visible in real time without leaving a browser. Built to replace spreadsheet-based compliance reporting. The AWS data comes from my own lab account.
- Live dashboard replacing manual spreadsheet-based compliance reporting
- Control status and failure trends visible in the browser
- Aggregates findings from both Security Hub and Config into a single view
- SQLite backend stores historical compliance data for trend analysis
Okta API Compliance Collector
Python tool that connects to a live Okta tenant through the REST API and collects SOC 2 identity evidence: the user roster, per-user MFA enrollment, group memberships, and authentication logs. Each dataset is mapped to its Trust Services Criterion and written to a structured Excel evidence workbook.
- 67% MFA compliance score from real tenant data, with the failing user documented as a CC6.6 finding
- Evidence mapped to SOC 2 CC6.1, CC6.3, CC6.6, and CC7.2
- Follows Okta's Link header pagination and handles free-tier rate limits gracefully
- Credentials kept out of source code with python-dotenv
Proof of work
Every claim above links to something you can open. These six are the shortest path.
GREEN PRCompliant PR: all 6 policy tests passing, merged cleanlyView on GitHubRED PRBlocked PR: a CM-6 violation (required ComplianceScope tag removed) caught and stopped by branch protectionView on GitHubTAMPER TESTCHAIN INTACT vs FAIL: one appended byte breaks the signed evidence chain immediatelyView on GitHubOSCAL VALIDtrestle validate returning VALID on both component definition and profile documentsView on GitHubPOLICY TESTS6 of 6 OPA/Rego policy tests passing across SC-28, AC-3, and CM-6View on GitHubCASE STUDYFull end-to-end case study with a proof link for every claimView on GitHub
Experience
Independent GRC Engineering
Remote
August 2026 to Present
- Independent GRC engineering work: completed a ten-project compliance automation curriculum in my own AWS lab account and earned CGE-AUD.
- Shipped an end-to-end compliance automation pipeline (Terraform, OPA/Rego, GitHub Actions, Cosign, OSCAL) mapped to NIST 800-53 controls SC-28, AC-3, CM-6, and AU-3, with 6 of 6 policy tests passing and a merged pull request plus a blocked pull request in the history.
- Project 11, an audit readiness pipeline from chapter 9 of the curriculum, is underway. The Certified GRC Engineer Practitioner course (CGE-P) is in progress. ISO 27001 Lead Auditor is in progress.
Project Manager
Legato Security (Managed Security Service Provider)
September 2025 to July 2026
- Led security service delivery for 10+ enterprise client accounts at an MSSP, coordinating across SOC analysts, engineers, and channel partners.
- Built and managed onboarding workflows in GuideCX with milestone tracking that got new clients up and running faster.
- Wrote Quarterly Business Reviews (QBRs) and delivery updates that translate technical security work into plain language for client leadership.
- Designed the connector setup workflow for Mave, a documented, repeatable process for engineers configuring client integrations.
Rehired into this role after a company-wide reduction in force ended the Cybersecurity Consultant position below. Two months between roles.
Cybersecurity Consultant
Legato Security
April 2025 to July 2025
- Designed and led patch and vulnerability management programs for aerospace and industrial clients across 279+ endpoints, prioritizing CVEs by risk level and business impact.
- Used Tenable.io, Nessus, and PDQ Connect to cut critical vulnerability remediation from several weeks to under 72 hours, more than 80% faster.
- Built a Patching-as-a-Service delivery framework that standardized remediation across client environments and reduced manual coordination.
- Authored audit-ready patching SOPs, risk classifications, and remediation documentation for regulated clients.
State IT Security Specialist
Arkansas Department of Public Safety
October 2024 to March 2025
- Maintained patch compliance above 95% across 500+ endpoints with PDQ Connect, through automated deployment and consistent remediation tracking.
- Handled IAM for the department, including provisioning, deprovisioning, MFA resets, and access reviews in Active Directory and Azure AD.
- Mapped controls to NIST 800-53, collected audit evidence, and prepared compliance documentation for state regulatory audits.
- Built vulnerability dashboards and KPI reports that gave IT leadership a clear picture of current risk.
Position eliminated due to state budget reallocation.
SOC Analyst
Bank OZK, a bank that followed SOC 2
October 2021 to June 2024
- Investigated and resolved 30+ phishing, malware, BEC, and DLP incidents per week in a financial-sector SOC, completing phishing investigations in under 20 minutes while maintaining SLAs and documenting findings for audit.
- Reduced phishing false-positive alerts by 40% through detection rule tuning across Proofpoint, Microsoft Defender, and Cisco SEG.
- Wrote DLP response SOPs that standardized how the team handled incidents and kept everything traceable.
- Worked with the security awareness team on phishing simulations and reporting habits. Phishing incidents dropped 40% over the same period.
System Operations Analyst I
FIS Global
June 2017 to October 2021
- Provided 24/7 enterprise systems monitoring using Splunk, and used PDQ Deploy for patch deployment, responding in real time to service disruptions and supporting incident root cause analysis.
- Maintained operational playbooks and documentation to support audit compliance and SLA consistency.
- Coordinated with global support teams to meet uptime targets and deliver timely status updates.
Skills
Cloud Platforms
- AWS Security Hub
- AWS Config
- AWS CloudTrail
- AWS S3
- AWS KMS
- AWS IAM
- AWS Lambda
- EventBridge
- Microsoft Azure (Azure AD)
Security and Compliance
- NIST 800-53
- ISO 27001
- SOC 2
- PCI DSS
- OPA/Rego
- Conftest
- OSCAL 1.2.1
- compliance-trestle
- Cosign/Sigstore
GRC Frameworks
- NIST 800-53 Rev 5
- SOC 2 TSC
- ISO 27001
- PCI DSS
- FFIEC
- GLBA
- FedRAMP/RMF
Tools and Technologies
- Tenable.io
- Nessus
- PDQ Deploy
- PDQ Connect
- Splunk
- Microsoft Sentinel
- Chronicle SIEM
- CrowdStrike
- Microsoft Defender
- Proofpoint
- Cisco SEG
- Jira
- GuideCX
- Google Gemini API
- Ollama (local LLMs)
Programming
- Python
- boto3
- Bash
- Terraform
- GitHub Actions
- JSON
- YAML
- Flask
- SQLite
Other Skills
- AI Risk Assessment
- LLM-assisted Policy Generation
- Prompt Engineering
- Vulnerability Management
- SOC Analysis
- Incident Response
- Threat Hunting
- Detection Tuning
- Patch Automation
- SLA Compliance
Certifications
- Certified GRC Engineer, Auditor Specialty (CGE-AUD) GRC Engineering Club2026 · Verify
- ISO 27001 Lead AuditorIn progress
- GRC Jumpstart: GRC Foundations in Cybersecurity SimplyCyber2024
- Practical Security Analyst Assessment (PSAA)In progress
- Introduction to Hacking Methodology2026
- Level 1 Cyber Threat Hunting Training2024
- SOAR Analyst (Google Cloud Siemplify)2024
- XM Cyber Exposure Management2024
- VMDR (Qualys): Vulnerability Management Detection and Response Qualys2024
- Insider Threat Detection (Teramind)2024
- Chronicle SIEM Fundamentals2024
- M.S. in Cybersecurity, Maryville University2021
Education
Master of Science (MS), CybersecurityMaryville University
Bachelor of Science (BS), Information TechnologyUniversity of Arkansas Grantham
Currently building
- CGE-P (Practitioner): Certified GRC Engineer Practitioner course, In Progress
- Project 11: Audit Readiness Pipeline, Chapter 9 of the GRC Engineering curriculum
- ISO 27001 Lead Auditor (in progress)
GRC Engineering Club