Luigi Carpio
GRC Engineer
SOC 2 · ISO 27001:2022 · NIST 800-53 · FedRAMP High · CJIS v6.1
I build open-source compliance automation where GRC, data engineering, and identity governance meet. Audit evidence is a data product. I use AI agent workflows and MCP integrations to build the tooling, across commercial and federal control sets: SOC 2, ISO 27001:2022, NIST 800-53, FedRAMP High, and CJIS.
Currently targeting: GRC Engineer roles at public-safety software vendors, federal integrators serving law enforcement, and FedRAMP-authorized platforms.
About
I spent years in law enforcement using public safety technology in the field. Now I build the compliance tooling for systems like those.
I write open-source Python and AWS tools for evidence collection, continuous monitoring, policy-as-code, and compliance-as-code. Mapped to SOC 2, ISO 27001:2022, NIST 800-53 Rev 5, FedRAMP High, and CJIS v6.1. I build with AI agent workflows and MCP integrations: one model writes the code, a separate model audits the diff before anything gets committed.
Before that I did Identity Governance at a financial services company: privileged access monitoring, user access reviews, RBAC analysis. Now I do product support at a FedRAMP High public safety software company.
Projects
Open-source work across commercial and federal control sets. Cards link out to GitHub; the README in each repo is the deep dive.
Flagships
Six leads. Three federal, three commercial. The commercial three are one arc: own the corpus, answer as the vendor, assess as the customer.
Federal
Evidence Warehouse
The layer after the audit scripts. Findings land in DuckDB against a per-source contract. dbt stages them into a queryable model; schema, completeness, and reconciliation tests pin that contract at the data layer. Fail loud. Lineage from source through staging to mart.
OSCAL Evidence Pipeline
I turn secret-scanner findings into OSCAL Assessment Results JSON. oscal-pydantic builds the models, and every CLI emit is validated against a vendored copy of the NIST OSCAL Assessment Results schema before it ships. Target shape: FedRAMP 20x machine-readable evidence.
AWS Compliance as Code
SCPs deny the non-compliant action at the org. CloudFormation lays down a baseline that is compliant by default: CloudTrail, IAM, KMS, Config, GuardDuty, Security Hub. The controls map to CJIS Security Policy, FedRAMP, and NIST 800-53. The point is showing how those frameworks turn into enforceable cloud policies, not paperwork.
Commercial
SOC 2 / ISO 27001 / NIST 800-53 Rev 5 Crosswalk
One mappings.yaml. SOC 2 Common Criteria as the pivot, with NIST 800-53 Rev 5 and ISO 27001:2022 Annex A hung off each criterion and a Strong/Partial/Contextual label. build_crosswalk.py emits Markdown, JSON, and CSV. --check fails on drift.
Security Questionnaire Responder
Drafts grounded answers to customer security questionnaires from a version-controlled SOC 2 / ISO 27001 control corpus, and abstains loudly when it can't. Every drafted answer carries an inline citation and a confidence tier inherited from the corpus. Questions the corpus cannot support return INSUFFICIENT_COVERAGE instead of a plausible guess.
Vendor Security Due Diligence
score_vendor.py scores a vendor on two axes against a CC9.2 / ISO A.5.19-A.5.23 checklist: the data-handling profile sets inherent risk, the weighted checklist sets assurance, and a matrix resolves the residual Low/Medium/High tier. Writes a memo plus JSON you can diff at annual re-review.
Built
Shipped or in progress. Each card links to the GitHub repo.
AWS Config Compliance Monitor
Config rules fire. SSM automation documents run the remediation. Lambda classifies severity and notifies. Continuous monitoring mapped to SI-4 and AU-6, with FedRAMP 20x KSI tracking in mind.
IAM Access Review
A user access review as a data pipeline, shaped by the reviews I used to run. Six identity extracts land in SQLite and reconcile against HR as the population of record, then SQL control checks find terminated-but-active, orphaned, dormant, and ownerless access. A recursive CTE flattens nested groups so privileged reach is the effective answer, not the direct-membership one. Emits an evidence packet with SHA-256 input hashes that regenerates byte-identical. Stdlib only. SOX ITGC framing, crosswalked to AC-2/AC-6 and SOC 2 CC6. v1.0 shipped 2026-08-23.
CJIS v6.1 to FedRAMP High Gap Analysis
FedRAMP High is not CJIS. I encoded where v6.x is stricter (AAL2 MFA, agency-managed CMKs) and where CJIS-only privacy controls have no FedRAMP High home. The output is an OSCAL overlay, not a spreadsheet.
NIST 800-53 Rev 5 to AWS Service Mapping
31 NIST 800-53 Rev 5 controls mapped to AWS services as an OSCAL Component Definition. A Python generator filters the output to FedRAMP High. Five of those controls call out where CJIS v6.1 forces a law enforcement deploy past the FedRAMP High baseline.
Policy-as-Code Scanner
I wrote a Python CLI that flags IAM policies that are too wide. Wildcard actions, missing MFA on CJI paths, open cross-account trusts. Non-zero exit and JSON evidence out. Runs in GitHub Actions.
Secret Scanner
Scans repos for the usual secrets, plus CJI identifiers most scanners miss: ORI numbers, NCIC codes, FBI Numbers, State IDs. Non-zero exit for CI. Mapped to IA-5(7), SC-12, SC-13, SC-28.
Roadmap
Planned next.
CJIS Encryption Validator
Planned. Check that CJI encryption in KMS meets FIPS 140-2/3 and agency-managed key rules where those go past FedRAMP High.
AI Risk Assessment Template
Planned template for public-safety AI risk, mapped to NIST AI RMF and ISO 42001 Annex A. Facial recognition, predictive policing, AI-assisted dispatch.
Skills
Compliance Frameworks
AI & Agentic Tooling
Technical Skills
GRC Tooling
Observability
Concepts
Certifications
CGE-P
GRC Engineering Club
SSCP
(ISC)²
CySA+
CompTIA
PenTest+
CompTIA
Security+
CompTIA
Network+
CompTIA
A+
CompTIA
Project+
CompTIA
ITIL 4
PeopleCert / Axelos
LPI LE
Linux Professional Institute