I was a sworn officer for years, using public safety technology in the field. Then I did Identity Governance at a financial services company: privileged access monitoring, user access reviews, RBAC analysis. Now I do product support at a FedRAMP High public safety software company, and I build the compliance tooling for systems like the ones I used in the field.

I write open-source Python and AWS tools for evidence collection, continuous monitoring, policy-as-code, and compliance-as-code. Mapped to SOC 2, ISO 27001:2022, NIST 800-53 Rev 5, FedRAMP High, and CJIS v6.1. I build with AI agent workflows and MCP integrations: one model writes the code, a separate model audits the diff before anything gets committed.

Open to: GRC Engineer | Security Compliance Engineer | Identity Governance Engineer | Compliance Data Engineer

Frameworks: SOC 2 | ISO 27001:2022 | NIST 800-53 Rev 5 | FedRAMP High | CJIS Security Policy v6.1 | NIST CSF 2.0

Certifications: CGE-P | SSCP | CySA+ | PenTest+ | Security+

Open-source work across commercial and federal control sets. The diagram is the federal pipeline: audit tools feeding monitoring and evidence. The commercial work runs on a separate track, where the questionnaire responder answers from the crosswalk's corpus.

graph LR
    A[Audit tools<br/>detect findings] --> B[Config monitor<br/>watches drift]
    B --> C[Remediation<br/>fixes violations]
    A --> D[Evidence logger<br/>collects records]
    D --> E[Compliance report<br/>visualizes]
    D --> F[Evidence warehouse<br/>dbt completeness]
    D --> G[OSCAL pipeline<br/>machine-readable SAR]

Seven leads. Three federal, three commercial, and one that sits across both. The commercial three are one arc: own the corpus, answer as the vendor, assess as the customer.

• Evidence Warehouse: A failed or delayed authorization blocks federal revenue, and most evidence programs are screenshots in a folder that get re-collected by hand every cycle. Raw findings land in DuckDB, dbt stages them into a queryable model, and completeness tests fail the build by name when a collector is missing. Lineage from API call to finding. v1.0 shipped 2026-08-12.
• OSCAL Evidence Pipeline: FedRAMP 20x wants machine-readable evidence, and hand-assembled Word SARs are the slowest, most error-prone step of an authorization package. Audit tool output becomes OSCAL Assessment Results JSON, with IBM Compliance Trestle handling the model work.
• AWS Compliance as Code: Every misconfiguration an auditor finds after the fact is a remediation cycle you pay for twice. SCPs deny the non-compliant action at the org, and CloudFormation lays down a baseline that is compliant by default: CloudTrail, IAM, KMS, Config, GuardDuty, Security Hub.
• SOC 2 / ISO 27001 / NIST Crosswalk: Collecting the same evidence three times for three frameworks is the most common waste in a commercial compliance program. One mappings.yaml with SOC 2 Common Criteria as the pivot, NIST 800-53 Rev 5 and ISO 27001:2022 Annex A hung off each criterion with a Strong/Partial/Contextual label. build_crosswalk.py emits Markdown, JSON, and CSV; --check fails on drift.
• Security Questionnaire Responder: Security questionnaires sit between a signed deal and revenue, and a confident wrong answer costs more than a slow one. Drafts grounded answers from the crosswalk corpus with an inline citation and a confidence tier, and returns INSUFFICIENT_COVERAGE instead of a plausible guess.
• Vendor Security Due Diligence: A vendor breach is your incident, and a review that can't be reproduced at annual re-review is a finding waiting to happen. score_vendor.py scores inherent risk from the data-handling profile and assurance from a weighted CC9.2 / ISO A.5.19-A.5.23 checklist, resolves a residual tier, and writes a decision memo plus JSON you can diff next year.
• IAM Access Review: Access reviews are where SOX ITGC audits fail, and the failure is almost never the wrong person having access. It is that you can't prove the population was complete. Six identity extracts land in SQLite, reconcile against HR as the population of record, and run through SQL control checks, with a recursive CTE flattening nested groups so privileged reach is the effective answer. Emits an evidence packet with SHA-256 input hashes that regenerates byte-identical. Stdlib only. v1.0 shipped 2026-08-23.

• NIST 800-53 Rev 5 to AWS Mapping: 31 controls mapped to AWS services as an OSCAL Component Definition. Generator filters to FedRAMP High and calls out where CJIS v6.1 pushes past that baseline.
• CJIS-FedRAMP Gap Analysis: A public-safety vendor that can't show the CJIS delta from its FedRAMP High baseline loses state and local deals it already qualifies for technically. Encoded where v6.x is stricter and where CJIS-only controls have no FedRAMP High home. Output is an OSCAL overlay.
• CGE-P Capstone: Graded CGE-P capstone, CMMC Level 2 mapped to NIST 800-171 Rev 3. I inherited an app with eight named gaps and wrapped it in four governance layers without touching the application: a Terraform baseline, an OPA suite that blocks regressions at the pull request, a pipeline that signs and vaults evidence on merge, and an OSCAL component definition an assessor can follow from control claim to signed artifact. Built to the exam spec and independently assessed.

• AWS Config Compliance Monitor: Config rules fire. Lambda remediates. SSM runs the playbook. Continuous monitoring (CA-7), with FedRAMP 20x KSI tracking in mind.
• AWS GRC Terraform Modules: Reusable Terraform modules for FedRAMP High and CJIS v6.1 baselines, with OPA/Rego tests and tfsec/checkov CI gates. Companion to the AWS Fundamentals Labs on luigicarpio.dev/blog.

• IAM Audit: MFA, access key rotation, credential hygiene.
• S3 Audit: Encryption, public access, versioning.
• Security Group Audit: Overly permissive inbound rules.
• CloudTrail Audit: Root usage, failed API calls, sensitive IAM / SG / Trail / S3 changes.
• Evidence Logger: Timestamped evidence files from compliance checks.
• Compliance Report: Pass/fail summaries from aggregated check data.

• Policy Checker: IAM policy scan for overly permissive configs and CJIS v6.1 violations.
• Secret Scanner: Usual secrets plus CJI identifiers (ORI, NCIC, FBI numbers, State IDs). Non-zero exit for CI. First adapter into the OSCAL pipeline.

• SQL for audit-evidence pipelines: dbt + DuckDB completeness and reconciliation tests in the evidence warehouse
• Terraform modules for compliant AWS resources (S3, EBS encryption baselines)
• OPA / Rego for plan-time policy gates on IaC
• OSCAL authoring (Assessment Results / SAR) for machine-readable evidence

Portfolio | LinkedIn | X | Medium | HackTheBox