Senior Cloud Engineer focused on AWS multi-account governance and compliance-as-code: FedRAMP (Rev5 and 20x) and NIST 800-53 controls implemented as code on AWS, in both commercial regions and GovCloud.

I build multi-account guardrails, audit evidence pipelines, and remediation workflows that run on short-lived credentials only (OIDC and IAM Identity Center, zero long-lived keys).

The projects use automated tests (Terraform, Python and Rego), CI security scans appropriate to their code, and documented coverage gaps. Where noted, it links to proof from a live deployment.

• fedramp-terraform-library: NIST 800-53 Rev5 and FedRAMP 20x controls as Terraform modules, with plan-time policy tests. Fifteen of its 23 modules deployed and probed in a real organization.
• aws-remediation-orchestrator: Security Hub findings routed through policy, blast-radius limits and a human approval gate. Six playbooks run against a real organization, and one finding traced from detection to evidence.
• aws-sso-broker: short-lived IAM Identity Center credentials across many accounts, with no long-lived access keys. Tested against a real Identity Center instance.

flowchart LR
  subgraph prevent["Prevent"]
    org["aws-org-guardrails<br/>org SCPs, permissions boundary,<br/>Bedrock and SageMaker guardrails"]
    lib["fedramp-terraform-library<br/>account baselines and auditors"]
  end
  subgraph access["Access"]
    sso["aws-sso-broker<br/>short-lived Identity Center credentials"]
  end
  subgraph detect["Detect"]
    prowler["prowler-aws-template<br/>org-wide CSPM scans"]
    wiz["wiz-cloud-config-rules<br/>custom Wiz CSPM rules"]
    sh["Security Hub findings"]
  end
  subgraph respond["Respond"]
    rem["aws-remediation-orchestrator<br/>governed auto-remediation"]
  end
  subgraph prove["Prove"]
    grc["grc-evidence-automation<br/>tamper-evident control evidence"]
  end
  prevent --> detect --> respond
  sh --> rem
  prevent --> prove
  respond --> prove

• aws-org-guardrails: SCPs, a permissions boundary, Identity Center permission sets and Bedrock/SageMaker guardrails for AWS Organizations, tested as policy behavior. Probed with 62 live probes.
• grc-evidence-automation: scheduled, tamper-evident control evidence for SOC 2, ISO 27001, NIST 800-53 and FedRAMP 20x. Deployed and verified in a live account.
• ai-agent-security-toolkit: prompt-injection fuzzer, tool-call sandbox with taint tracking, output validation and a tamper-evident audit log for LLM agents. Fuzzed with 500 attacks against a local Llama 3.1 8B model: forbidden tool calls, leaks and exfiltration went from 65 to zero.
• prowler-aws-template: org-wide Prowler scans through GitHub Actions and OIDC, with a documented cost model. Run against a real four-account organization.
• wiz-cloud-config-rules: custom Wiz Cloud Configuration Rules in Rego, mapped to NIST 800-53 and GovCloud-safe, with 162 opa test cases.
• claude-code-guardrails: guardrails for AI coding agents on AWS and Terraform that block risky commands and catch secrets before they are written.

Design decisions and deployment evidence: why these systems use short-lived access, policy-gated remediation and verifiable evidence, with the scope and limits of each live run.

I connect observed attack techniques to specific controls and regression checks. Each entry in the threat response log names a technique, the control added for it, and any public reporting of attackers using it. The most recent:

• Using stolen laptop credentials against signing keys from outside the network: the repos already restricted Regions, kept Identity Center sessions short, and could revoke stolen role sessions. An opt-in SCP statement now denies signing, decrypting and re-granting tagged KMS keys unless the call comes through an organization VPC endpoint, in aws-org-guardrails#41. Seen in the wild: CoinDesk, 2026.

Cloud: AWS (including GovCloud)
Infrastructure as code: Terraform, GitHub Actions
Languages: Python, HCL, Rego, PowerShell, Bash
Security tooling: Checkov, Trivy, Gitleaks, Prowler, Wiz, OPA, Security Hub, GuardDuty, AWS Config
Frameworks: FedRAMP Rev5 and 20x, NIST 800-53 Rev5, SOC 2, ISO 27001:2022
AI assistance: I use AI coding assistants (Claude Code) for drafting and review. I design each system, and I verify it with tests and, where noted, live deployments.