Security projects, minus the theater

Led SOC 2 and ISO 27001 programs from discovery through audit

Led the implementation of SOC 2 Type II for a company in the energy space and ISO 27001 for an insurance-industry company. In both cases, I owned the program end to end: discovery, policy writing, control implementation, evidence collection, stakeholder coordination, and the full audit process.

Both audits resulted in good reports with no major findings. More importantly, the programs were built to be useful after certification: controls mapped to real systems, policies reflected how the business actually operated, and evidence collection became part of normal work instead of a last-minute audit scramble.

• Mapped requirements to cloud, identity, SDLC, vendor, incident-response, and governance controls.
• Wrote policies that were practical enough for engineering and business teams to follow.
• Kept the security program focused on reducing real risk, not just collecting a certificate.

Reworked AWS access around just-in-time permissions

Introduced a new way of accessing AWS resources through AWS Identity Center connected to Okta. Instead of relying on standing elevated access, users requested temporary permissions through Okta Access Requests, with approvals and time limits built into the access path.

Those permission grants also flowed into EKS Access Entries, so Kubernetes access followed the same model as cloud access: explicit, time-bounded, reviewable, and tied back to identity rather than long-lived manual exceptions.

• Connected Okta identity workflows to AWS Identity Center permission sets.
• Moved elevated AWS access toward approved, limited-duration grants.
• Extended the same identity-driven access model into EKS cluster authorization.

Introduced Zero Trust access for private networks and applications

Introduced Cloudflare WARP as the access layer for private subnets and internal applications, connected back to Okta so network access could be governed by identity rather than broad VPN-style trust. Access decisions could then account for who the user was, what they needed, and which applications or networks they were allowed to reach.

• Connected Cloudflare WARP to Okta for identity-aware access to selected subnets and applications.
• Moved internal access toward Zero Trust patterns instead of implicit network trust.
• Made access easier to grant, revoke, and review without opening broad paths by default.

Brought security thinking to fast-moving LLM adoption

Helped teams reason about LLM use the same way they reason about any other new system: data flow, abuse cases, logging, monitoring, vendor risk, and human review. The useful version of AI governance is practical enough that people can follow it while they are shipping.

• Framed AI risk around real workflows rather than abstract policy language.
• Identified where guardrails, monitoring, and review actually reduce exposure.
• Balanced experimentation with clear rules for sensitive data and production use.