Security is the foundation, not the add-on.

Over a decade turning regulatory requirements into controls that hold at runtime rather than controls that merely get documented. Two and a half years at Rise8 architecting a GRC engineering program inside a secure federal release pipeline: writing the Rego that enforced the controls, designing the exceptions process around them, and defending the risk decisions to Authorizing Officials. Earlier, third-party risk at Amazon, enterprise security exceptions at PepsiCo, classified RMF and ATO work in eMASS at Sev1Tech, and audit foundations at Bowhead, all grounded by my time in the United States Air Force. Today, at OpenLoop Health, I am wiring AI-assisted governance and vendor risk reviews into real systems of record and putting governance around agentic AI tools. I care about this field, and I want it to grow up.

How I think about it

Compliance is a product, not paperwork.

A control that does not enforce itself is a story we tell auditors. Version it, test it, deploy it, observe it.

If a human has to validate it every time, it is a liability.

Manual evidence scales with auditors. Pipeline-native enforcement makes assurance a side effect of doing the work.

Trust is earned through transparency, not binders.

The right answer to "are we secure?" is a live dashboard, not a stack of PDFs from last quarter.

Right-size the controls, then defend the right-sizing.

Checkbox compliance costs more than the risk it mitigates and gives engineers a reason to route around you.

What is next

Agents that collect evidence the moment it is created, map plain-language requirements to the telemetry that proves them, and explain drift instead of just flagging it. Prototyping it in the Playground curriculum first.