Senior Cybersecurity / ISSO and USMC veteran with 9+ years securing DoD and federal systems — from full RMF lifecycle execution in eMASS to compliance-as-code engineering on AWS.
I'm a Senior Cybersecurity / ISSO professional and bilingual U.S. Marine Corps veteran with over 9 years of hands-on experience securing mission-critical DoD, federal civilian, and healthcare systems from threat assessment through authorization.
My specialty is the full RMF lifecycle in eMASS — I've led control selection through ATO and continuous monitoring across Army, Navy, and federal civilian environments, achieving consecutive Authorization to Operate approvals on mission-critical systems.
What makes me different: I don't just execute compliance checklists — I build GRC as code. My portfolio implements NIST 800-53 controls as Terraform, AWS infrastructure, and machine-readable OSCAL — bridging traditional GRC documentation with modern DevSecOps engineering.
Most recently, I supervised a team of 18+ ISSOs, Security Control Assessors, and Information Security Managers delivering consecutive ATO approvals — operating with the precision of a technical analyst and the leadership of a senior advisor.
End-to-end NIST RMF execution for a FedRAMP Moderate cloud-native federal SaaS system. Terraform + Checkov policy-as-code, CI pipeline emitting machine-readable OSCAL Assessment Results, full OSCAL document family (Profile, Component Definitions, SSP with 13 control implementations), POA&M tracking, continuous monitoring dashboard, Trivy scanning, Cosign image signing, and CycloneDX SBOMs.
An AWS Bedrock agent (Claude Haiku 4.5) automating full IAM employee offboarding in under 60 seconds via 4 Lambda action groups. Implements NIST SP 800-53 controls AC-2, AC-3, AC-6, PS-4, IA-4, AU-2/9/11/12, IR-6, SC-28, SI-12 with S3 evidence archival and DynamoDB audit logging. Solves orphaned-account audit findings in seconds, not weeks.
AWS-native automated POA&M pipeline using Security Hub + GuardDuty + EventBridge + Lambda + DynamoDB. Maps findings to NIST 800-53 control families with risk-based milestone scheduling (HIGH 30 / MED 90 / LOW 180 days). Implements CA-7 continuous monitoring with REST API and dashboard — directly addressing the most common ATO bottleneck.
Secure AWS EC2 deployment using CloudFormation with embedded GRC controls. Demonstrates compliance-as-code — infrastructure provisioned with security guardrails, least-privilege IAM policies, and audit logging baked in from day one.
A JavaScript-based tracker for managing systems through the NIST Risk Management Framework lifecycle. Tracks authorization status, control implementation states, and assessment milestones across multiple systems — bringing visibility to what's usually a manual, spreadsheet-driven process.
Python-based monitoring tool targeting AWS EC2 environments for GRC compliance visibility. Surfaces configuration states and security posture data relevant to continuous monitoring requirements under RMF — bridging cloud infrastructure and compliance reporting.
Interactive JavaScript-based platform for cybersecurity awareness and security training. Reflects security awareness program development work from real-world DoD healthcare environments — translating enterprise training program design into a deployable web tool.
Building cloud-native security automation on AWS — IAM policy governance, Security Hub integrations, and compliance-as-code pipelines for FedRAMP workloads.
Deepening FedRAMP High and Moderate authorization expertise — OSCAL document family generation, 3PAO assessment processes, and continuous monitoring at scale.
Exploring AI/ML security governance under NIST AI RMF 1.0 — mapping traditional cybersecurity controls to emerging AI system threat models and compliance requirements.
Open to cybersecurity roles in GRC engineering, cloud security, and federal or defense environments. TS clearance — eligible for reactivation. Available for immediate consideration.
Whether you're looking for a senior GRC engineer, a cloud security architect with federal experience, or a cybersecurity program lead — let's talk.