Senior Cloud Engineer focused on AWS multi-account governance and compliance-as-code: FedRAMP (Rev5 and 20x) and NIST 800-53 controls implemented as code on AWS, in both commercial regions and GovCloud.

I build multi-account guardrails, audit evidence pipelines, and remediation workflows that run on short-lived credentials only (OIDC and IAM Identity Center, zero long-lived keys).

The projects use automated tests (Terraform, Python and Rego), CI security scans appropriate to their code, and documented coverage gaps. Where noted, it links to proof from a live deployment.

• fedramp-terraform-library: NIST 800-53 Rev5 and FedRAMP 20x controls as Terraform modules, with plan-time tests that check the rendered IAM and bucket policies. Thirteen modules deployed and probed in a real organization, including live connections to the database, the container registry and the web ACL.
• aws-remediation-orchestrator: Security Hub findings routed through policy, blast-radius limits and a human approval gate. All six playbooks run against a real AWS organization, and one finding followed from detection to exported evidence, including an approval whose delivery failed and was recovered.
• aws-sso-broker: short-lived IAM Identity Center credentials across many accounts, with no long-lived access keys. Tested against a real Identity Center instance.

flowchart LR
  subgraph prevent["Prevent"]
    org["aws-org-guardrails<br/>org SCPs, permissions boundary,<br/>Bedrock and SageMaker guardrails"]
    lib["fedramp-terraform-library<br/>account baselines and auditors"]
  end
  subgraph access["Access"]
    sso["aws-sso-broker<br/>short-lived Identity Center credentials"]
  end
  subgraph detect["Detect"]
    prowler["prowler-aws-template<br/>org-wide CSPM scans"]
    wiz["wiz-cloud-config-rules<br/>custom Wiz CSPM rules"]
    sh["Security Hub findings"]
  end
  subgraph respond["Respond"]
    rem["aws-remediation-orchestrator<br/>governed auto-remediation"]
  end
  subgraph prove["Prove"]
    grc["grc-evidence-automation<br/>tamper-evident control evidence"]
  end
  prevent --> detect --> respond
  sh --> rem
  prevent --> prove
  respond --> prove

• aws-org-guardrails: SCPs, a permissions boundary and Identity Center permission sets for AWS Organizations, tested as policy behavior against the JSON Terraform renders, plus Bedrock and SageMaker guardrails: SCPs, agent IAM audits, invocation-logging enforcement and cost controls. SCPs, the boundary and a permission set probed with 62 live API calls.
• grc-evidence-automation: scheduled, tamper-evident control evidence for SOC 2, ISO 27001, NIST 800-53 and FedRAMP 20x. Deployed and verified in a live account.
• ai-agent-security-toolkit: prompt-injection fuzzer, tool-call sandbox with taint tracking, output validation and a tamper-evident audit log for LLM agents.
• prowler-aws-template: org-wide Prowler scans with a documented cost model with GitHub Actions, OIDC and StackSet read-only roles. Run against a real four-account organization.
• wiz-cloud-config-rules: custom Wiz Cloud Configuration Rules for AWS in Rego, mapped to NIST 800-53, with a Terraform module that loads them into a tenant. Missing data fails instead of passing, and no rule hard-codes the partition, so the rules work in GovCloud. 146 opa test cases across nine rules.

Design decisions and deployment evidence: why these systems use short-lived access, policy-gated remediation and verifiable evidence, with the scope and limits of each live run.

I connect observed attack techniques to specific controls and regression checks. Each entry in the threat response log names a technique, the control added for it, and public reporting of attackers using it. The most recent:

• Injected workflows assuming OIDC roles: the trust-policy auditor already graded missing and wildcard sub and aud conditions on GitHub OIDC trusts. It now also reports a trust with no workflow pin, in fedramp-terraform-library v2.1.0. Seen in the wild: Socket, 2026.

Cloud: AWS (including GovCloud)
Infrastructure as code: Terraform, GitHub Actions
Languages: Python, HCL, Rego, PowerShell, Bash
Security tooling: Checkov, Trivy, Gitleaks, Prowler, Wiz, OPA, Security Hub, GuardDuty, AWS Config
Frameworks: FedRAMP Rev5 and 20x, NIST 800-53 Rev5, SOC 2, ISO 27001:2022
AI assistance: I use AI coding assistants (Claude Code) for drafting and review. I design each system, and I verify it with tests and, where noted, live deployments.