Completed work, in depth.
Seven projects across the identity and cloud security stack: non-human identity governance, IGA lifecycle automation, GRC engineering, policy-as-code guardrails, identity threat detection, Zero Trust, and multi-account architecture, with working code and outcomes from controlled AWS environments.
AWS NHI Governance Engine
A non-human identity governance engine that scans an AWS account and scores the identities people forget — IAM roles, users, access keys, secrets, and trust policies — mapping every finding to the OWASP NHI Top 10 and NIST 800-53, and gating CI on unaccepted high-severity risk.
- Eleven detectors: ownership, over-privilege (managed-policy admin and unused permissions via Access Advisor), trust-policy exposure (wildcard, cross-account without ExternalId, OIDC aud/sub gaps), and credential model
- Runs in CI via GitHub OIDC federation with no stored credentials, on a least-privilege read-only role
- Exception register with time-boxed risk acceptance and net-residual-risk reporting — open risk separated from signed-off risk
- JSON and Markdown audit reports rendered in the CI run summary; documented threat model for the scanner itself
- Packaged as a tested Python library; the gate fails the build on open HIGH or CRITICAL findings
Enterprise IAM Lifecycle Automation
An end-to-end Identity Governance and Administration build: HR-sourced joiner, mover, and leaver lifecycle on midPoint and 389 Directory Server, with reconciliation, non-human identity disposition, and a Python evidence validator that proves the directory matches the source of truth.
- HR-driven joiner, mover, and leaver provisioning and deprovisioning into 389 Directory Server via midPoint
- Reconciliation that surfaces out-of-band changes and orphaned accounts, with disablement before deletion
- Unmatched service-account (non-human identity) disposition: link to owner, remove, or document as a time-bound exception
- Python evidence validator comparing the HR source against the directory, emitting control-mapped JSON findings
- Three-way identity correlation and SOC 2 CC6 access-control mapping for audit-style evidence
AWS Continuous Compliance Automation Framework
An engineering-driven approach to Governance, Risk, and Compliance on AWS. This framework interrogates AWS APIs directly — producing structured evidence, risk-scored findings, and audit-style reporting across six major compliance frameworks simultaneously.
- 16 automated controls across IAM, S3, CloudTrail, GuardDuty, and Security Hub
- Risk scoring engine with compliance percentage, severity grouping, and prioritized remediation
- IAM Governance module — stale users, unused keys, leaver validation with three-way identity correlation
- Immutable evidence vault using S3 Object Lock — tamper-proof audit artifacts
- Single automated check satisfies CIS, NIST 800-53, SOC 2, ISO 27001, and PCI DSS simultaneously
AWS Policy-as-Code Guardrails
Preventive guardrails that evaluate a Terraform plan before apply and fail the build when a change would violate a security control. The shift-left counterpart to the NHI engine: the engine detects risky identities that already exist, these guardrails stop a class of misconfigurations from ever deploying.
- OPA Rego policies executed with Conftest against
terraform show -jsonplan output - Denies public S3, security groups open to 0.0.0.0/0 or ::/0, wildcard IAM, unencrypted storage, and missing Owner tags
- Every policy mapped to NIST 800-53 (SC-7, AC-6(10), SC-28, CM-8)
- Unit-tested with
opa testand enforced as a GitHub Actions CI gate that blocks violating plans
Real-Time IAM Cross-Account Detection Pipeline
An event-driven detection pipeline that surfaces high-signal IAM anomalies in near real-time. Built with a QA engineer's approach to signal quality — systematic false positive tuning distinguishes legitimate activity from genuine risk.
- CloudTrail → EventBridge → Lambda enrichment → SNS alert pipeline
- Targets unauthorized AssumeRole activity, misconfigured trust policies, and cross-account anomalies
- False-positive tuning for CI/CD roles, Lambda execution, and developer sessions
- Structured JSON findings with context, severity, and embedded remediation guidance
Zero Trust Serverless Architecture on AWS
A three-stack AWS serverless application built on Zero Trust design principles — every request authenticated, every resource encrypted, every action logged. Demonstrates the IAM and data protection controls validated by the GRC Engineering framework, built as infrastructure as code with AWS CDK.
- Cognito JWT authentication with API Gateway HTTP API v2 — identity-before-connect enforced
- Split Lambda execution roles — each function scoped to exact required permissions only
- KMS CMK encryption, DynamoDB PITR, stage-aware deletion protection guardrails
- Structured CloudWatch logging and X-Ray tracing across all three stacks
- Deployed via AWS CDK Python — infrastructure as repeatable, reviewable, versioned code
Secure Multi-Account AWS Architecture for Retail Platforms
A security-first AWS reference architecture for retail workloads — demonstrating architect-level thinking across trust boundary separation, multi-account org design, and layered security controls. Grounded in real retail business context: customer identity, order workflows, payment-adjacent services, and prod/non-prod isolation.
- Multi-account AWS Organizations model with dedicated management, security/log archive, shared services, production, and non-production accounts
- Layered ingress: Route 53 → CloudFront → WAF → ALB → private subnets — reducing attack surface at every boundary
- Threat model documenting retail platform threats, trust boundaries, business impact, and mitigations per attack vector
- Security controls mapped across preventive, detective, responsive, and governance categories — the full control lifecycle
- Architecture Decision Records explaining why each major design choice was made — not just what was built