Built, with the receipts.
Four things live, one in progress. I would rather show the unfinished one honestly than wait until it is polished.
GRC Playground
Hands-on labs that turn compliance analysts into GRC engineers. Most GRC people know the what. The Playground teaches the how.
Every lab starts from a real misconfiguration, runs in the browser so there is nothing to install, and ends by tying the exercise back to continuous authorization. Two paths: RMF Fundamentals for the authorization mechanics, Entry Level GRC Engineering for writing the enforcement.
Published labs
- Lab 01Deny Public S3 Buckets
Refuse an S3 configuration that allows public ACLs.
→ - Lab 02Block Open Security Groups
Catch 0.0.0.0/0 ingress before it reaches an environment.
→ - Lab 03IAM Policy Audits
Flag wildcard actions and resources, then enforce it.
→ - Lab 04MFA for Privileged Accounts
IA-2(1): fail any privileged account without MFA.
→ - Lab 05Control Mapping for Beginners
Connect an 800-53 control to the thing that actually satisfies it.
→
package s3 deny[reason] { input.PublicAccessBlockConfiguration.BlockPublicAcls == false reason = "S3 bucket allows public ACLs" }
Six lines. A control does not have to be complicated to be real. It has to run.
Policy Library
Rego controls that know which requirement they satisfy and emit evidence when they run. I built the first one inside Rise8's federal release pipeline, where it enforces controls at deploy time. This is the public version, built in the open.
Three rules. Every policy carries its control identifiers in metadata. Every evaluation emits a structured evidence record, not just pass or fail. Every policy ships with a test and an input that fails, because a control nobody has watched fail is a control nobody has verified. First up: session timeouts, MFA on privileged access, public exposure of storage and network, secrets in configuration, image signing.
HIPAA controls-as-code
The CGE-P capstone. HIPAA Security Rule controls enforced as code on a patient-intake application: Terraform for the infrastructure, OPA and Rego policy gates enforced through GitHub Actions rulesets, and evidence captured automatically on AWS.
A pull request cannot merge unless the policy gate passes, and every gate run leaves an evidence record tied to the control it satisfies. The same shape as the pipeline on the home page, built end to end on a real cloud account.
The GRC Practitioner Workbook
Two volumes, roughly 728 pages, on the analyst-to-engineer transition across RMF, controls automation, and continuous authorization.
GRC Engineering Club
Head of Career Operations: the programming, resources, and introductions that turn an analyst's interest into an engineer's first role.