Senior Cloud Engineer focused on AWS multi-account governance and compliance-as-code: FedRAMP (Rev5 and 20x) and NIST 800-53 controls implemented as code on AWS, in both commercial regions and GovCloud.

I build multi-account guardrails, audit evidence pipelines, and remediation workflows that run on short-lived credentials only (OIDC and IAM Identity Center, zero long-lived keys).

The projects use automated tests (Terraform, Python and Rego), CI security scans appropriate to their code, and documented coverage gaps. Where noted, it links to proof from a live deployment.

• fedramp-terraform-library: NIST 800-53 Rev5 and FedRAMP 20x controls as Terraform modules, with plan-time policy tests. Sixteen of its 23 modules deployed and probed in a real organization.
• aws-remediation-orchestrator: Security Hub findings routed through policy, blast-radius limits and a human approval gate. Six playbooks run against a real organization, and one finding traced from detection to evidence.
• aws-sso-broker: short-lived IAM Identity Center credentials across many accounts, with no long-lived access keys. Tested against a real Identity Center instance.

flowchart LR
  subgraph prevent["Prevent"]
    org["aws-org-guardrails<br/>org SCPs, permissions boundary,<br/>Bedrock and SageMaker guardrails"]
    lib["fedramp-terraform-library<br/>account baselines and auditors"]
  end
  subgraph access["Access"]
    sso["aws-sso-broker<br/>short-lived Identity Center credentials"]
  end
  subgraph detect["Detect"]
    prowler["prowler-aws-template<br/>org-wide CSPM scans"]
    wiz["wiz-cloud-config-rules<br/>custom Wiz CSPM rules"]
    sh["Security Hub findings"]
  end
  subgraph respond["Respond"]
    rem["aws-remediation-orchestrator<br/>governed auto-remediation"]
  end
  subgraph prove["Prove"]
    grc["grc-evidence-automation<br/>tamper-evident control evidence"]
  end
  prevent --> detect --> respond
  sh --> rem
  prevent --> prove
  respond --> prove

• aws-org-guardrails: SCPs, a permissions boundary, Identity Center permission sets and Bedrock/SageMaker guardrails for AWS Organizations, tested as policy behavior. Probed with 62 live probes.
• grc-evidence-automation: scheduled, tamper-evident control evidence for SOC 2, ISO 27001, NIST 800-53 and FedRAMP 20x. Deployed and verified in a live account.
• ai-agent-security-toolkit: prompt-injection fuzzer, tool-call sandbox with taint tracking, output validation and a tamper-evident audit log for LLM agents. Fuzzed with 500 attacks against a local Llama 3.1 8B model: forbidden tool calls, leaks and exfiltration went from 65 to zero.
• prowler-aws-template: org-wide Prowler scans through GitHub Actions and OIDC, with a documented cost model. Run against a real four-account organization.
• wiz-cloud-config-rules: custom Wiz Cloud Configuration Rules in Rego, mapped to NIST 800-53 and GovCloud-safe, with 162 opa test cases.
• claude-code-guardrails: guardrails for AI coding agents on AWS and Terraform that block risky commands and catch secrets before they are written.

Design decisions and deployment evidence: why these systems use short-lived access, policy-gated remediation and verifiable evidence, with the scope and limits of each live run.

I connect observed attack techniques to specific controls and regression checks. Each entry in the threat response log names a technique, the control added for it, and any public reporting of attackers using it. The most recent:

• EC2 termination protection used against responders: attackers mining with stolen IAM credentials turned on termination protection so their instances couldn't be deleted until someone switched it off, and nothing in the guardrails limited who could change it. An opt-in SCP now denies changing termination or stop protection except to exempt roles, confirmed against live AWS, in aws-org-guardrails#46. Reported: Amazon, 2025, a cryptomining campaign on EC2 and ECS.

Cloud: AWS (including GovCloud)
Infrastructure as code: Terraform, GitHub Actions
Languages: Python, HCL, Rego, PowerShell, Bash
Security tooling: Checkov, Trivy, Gitleaks, Prowler, Wiz, OPA, Security Hub, GuardDuty, AWS Config
Frameworks: FedRAMP Rev5 and 20x, NIST 800-53 Rev5, SOC 2, ISO 27001:2022
AI assistance: I use AI coding assistants (Claude Code) for drafting and review. I design each system, and I verify it with tests and, where noted, live deployments.