Compliance that runs in the pipeline, not in a binder.

Staff GRC Engineer at OpenLoop Health, Certified GRC Engineer. Twelve years turning RMF, NIST 800-53, HIPAA, and SOC 2 into controls a system can prove, and now the AI governance layer on top. Founder of GRC Playground.

See the work → GRC Playground
CertifiedCGE-P, 2026
ClearanceTop Secret
ServiceUS Air Force
policy/ac-12.regoGRC Playground
package main
import rego.v1

# AC-12: session timeout, capped at 900 s
deny contains msg if {
  input.application.settings.session_timeout > 900
  msg := sprintf("AC-12: %ds exceeds 900",
    [input.application.settings.session_timeout])
}
decision logreplay

      

      
A real control from the Playground labs, and Conftest evaluating it. One input fails, one passes.

    

  






  

    

      Selected work
      
Built, and building.

    

    
  






  

    

      How it works
      

        
How a commit becomes an authorized system.

        
Every gate enforces a control and hands evidence to the next. By the time an assessor looks, the answer is already a system answer.

      

    


    

    

      
CM-3
Commit A reviewed merge request, so change control is a property of the workflow.

      
SA-11
Build and test Developer testing evidence, collected where it already happens.

      
RA-5
Scan Findings with owners and clocks, not PDFs.

      
CM-6
Policy check Rego refuses what fails, at deploy time.

      
CA-7
Evidence A signed record per gate, tagged with the controls it satisfies.

      
CA-2
Assessor Reads live telemetry instead of a point-in-time package.

      
CA-6
Authorized Continuous, because the signal is.

    

  






  

    

      Experience
      
Twelve years, five kinds of environment.

    

    
    
      
  • Jun 2026 → now
    Staff Security Engineer, GRC Engineering
    OpenLoop Health · digital health
    Staff engineer on a newly formed security GRC function, chartered to automate it. Leading the Vanta compliance platform roadmap and data model, building the AI governance and third-party risk review automation that evaluates use cases and vendors against policy and lands in systems of record, and running the company's first agentic AI proof of value through its own AI governance intake.
    • 
      
  • Dec 2023 → Jun 2026
    Senior InfoSec Analyst, GRC Engineering
    Rise8 · defense software
    Architected and led a GRC engineering program inside a secure CI/CD release pipeline, replacing document-driven compliance with controls-as-code and automated evidence mapped to NIST 800-53 Rev. 5 and SSDF. Built the Policy Library in Rego and OPA that enforces controls at deploy time and emits structured evidence, designed the exceptions and break-glass process, drove cATO strategy with Authorizing Officials, and built the enablement track that turned analysts into GRC engineers.
    • 
      
  • Aug 2022 → Dec 2023
    3P Security Specialist
    Amazon
    Third-party vendor risk assessments against ISO 27001 at hyperscale, with compensating-control design, residual-risk decisions, and systemic gaps raised as program-level recommendations.
    • 
      
  • Oct 2021 → Aug 2022
    Security Exceptions Specialist
    PepsiCo
    Adjudicated enterprise security exceptions across a global Fortune 50, right-sized to actual residual risk.
    • 
      
  • Aug 2019 → Oct 2021
    Cyber Security Analyst and GRC Subject Matter Expert
    Sev1Tech · federal contracting
    ATO workflows in eMASS across classified and unclassified systems, and the first time I wired automated assessments into a pipeline.
    • 
      
  • Mar 2019 → Aug 2019
    Data Migration Technician
    UICGS / Bowhead · Dahlgren, VA
    Built an audit process tracking over 200 systems with recurring backup requirements for disaster recovery compliance, and coordinated Configuration Control Board operations across system owners.
    • 
      
  • Jan 2014 → Nov 2017
    Cyber Services Technician
    United States Air Force
    SharePoint administration and Tier 1 and 2 support in military operational environments. Presidential Volunteer Service Award.
    • 
    

  






  

    

      Writing
      

        
Notes on modern GRC.

        
Continuous authorization, Policy-as-Code for federal teams, the analyst-to-engineer move, and right-sizing controls.

        
Read the archive →