GRC Engineer
Compliance as code. Evidence as data. Nothing left to chance.
SOC 2 · ISO 27001:2022 · NIST 800-53 · FedRAMP High · CJIS v6.1
I build open-source compliance automation where GRC, data engineering, and identity governance meet. Audit evidence is a data product. I use AI agent workflows and MCP integrations to build the tooling, across commercial and federal control sets: SOC 2, ISO 27001:2022, NIST 800-53, FedRAMP High, and CJIS.
The layer after the audit scripts. Findings land in DuckDB against a per-source contract. dbt stages them into a queryable model; schema, completeness, and reconciliation tests pin that contract at the data layer. Fail loud. Lineage from source through staging to mart.
I turn secret-scanner findings into OSCAL Assessment Results JSON. oscal-pydantic builds the models, and every CLI emit is validated against a vendored copy of the NIST OSCAL Assessment Results schema before it ships. Target shape: FedRAMP 20x machine-readable evidence.
SCPs deny the non-compliant action at the org. CloudFormation lays down a baseline that is compliant by default: CloudTrail, IAM, KMS, Config, GuardDuty, Security Hub. The controls map to CJIS Security Policy, FedRAMP, and NIST 800-53. The point is showing how those frameworks turn into enforceable cloud policies, not paperwork.
One mappings.yaml. SOC 2 Common Criteria as the pivot, with NIST 800-53 Rev 5 and ISO 27001:2022 Annex A hung off each criterion and a Strong/Partial/Contextual label. build_crosswalk.py emits Markdown, JSON, and CSV. --check fails on drift.
Drafts grounded answers to customer security questionnaires from a version-controlled SOC 2 / ISO 27001 control corpus, and abstains loudly when it can't. Every drafted answer carries an inline citation and a confidence tier inherited from the corpus. Questions the corpus cannot support return INSUFFICIENT_COVERAGE instead of a plausible guess.
score_vendor.py scores a vendor on two axes against a CC9.2 / ISO A.5.19-A.5.23 checklist: the data-handling profile sets inherent risk, the weighted checklist sets assurance, and a matrix resolves the residual Low/Medium/High tier. Writes a memo plus JSON you can diff at annual re-review.
A user access review as a data pipeline, shaped by the reviews I used to run. Six identity extracts land in SQLite and reconcile against HR as the population of record, then SQL control checks find terminated-but-active, orphaned, dormant, and ownerless access. A recursive CTE flattens nested groups so privileged reach is the effective answer, not the direct-membership one. Emits an evidence packet with SHA-256 input hashes that regenerates byte-identical. Stdlib only. SOX ITGC framing, crosswalked to AC-2/AC-6 and SOC 2 CC6. v1.0 shipped 2026-08-23.
Public and private subnets across two AZs, a chained least-privilege security group set, deny-by-default NACLs, VPC endpoints for S3 and KMS, and Flow Logs into the Lab 2 WORM bucket: the SC-7 boundary pattern for a CJI enclave, mapped to NIST 800-53 Rev 5, FedRAMP High, and CJIS v6.1.
SSE-KMS with a customer-managed CMK, Object Lock WORM retention, a TLS-only policy, and account-wide EBS encryption-by-default: the compliant-storage baseline every audit artifact in this series lands in, mapped to NIST 800-53 Rev 5, FedRAMP High, and CJIS v6.1.
I hardened the study account I had been clicking around in for months. A credential report found a 203-day access key, no password-reuse prevention, and no cost guardrail. I assessed, remediated, and proved the baseline against NIST 800-53 Rev 5, FedRAMP High, and CJIS v6.0.