GRC · Identity and access · Microsoft 365

IT and GRC, built hands-on.

Six years in Amazon operations taught me that a control only works when people follow it and you can prove it. Now I build the systems and the evidence.

Looking for

Entry-level roles in GRC and compliance, IT audit, Microsoft 365 administration or identity and access, in Orlando or remote. I'd especially value a team that mentors.

See the work Resume Email me

STIG Viewer compliance chart: 225 rules assessed, 137 open, 75 not a finding, 13 not applicable, 0 not reviewed, scoring 35 percent. — Real output, not a mockup: a pre-hardening baseline scan of a Windows 10 VM. 35% is the starting point the work begins from. Read the case study →

63–70% → 99%+

SOX audit compliance, in one month

Amazon, 2023

Security+

with CompTIA Network+, A+, and ITIL 4 Foundation

2025–2026

GRC labs mapped to NIST 800-53, NIST 800-171, and PCI DSS 4.0.1

public repos on GitHub

Selected work

Featured case studies

All case studies →

GRC Security Program

A full security program for a fictional coffee shop: risk register, 15 NIST 800-53 controls crosswalked to PCI DSS 4.0.1, an evidence pack with automated checks, a vendor risk assessment, and quarterly access reviews.

Simulationgrc iam

Workspace intranet

A data-driven intranet that runs identically from memory, the browser, or a real Microsoft 365 tenant — live-tenant verified, a stored XSS found and fixed across 60 sinks, 454 automated checks.

In progressm365 iam security

Cyber Home Lab

Entra ID and SharePoint governance built in a real Microsoft 365 tenant — then reviewed against itself, which is how I found that the audit log had never been turned on.

In progressm365 iam grc

Also

Websites and tools for small businesses

I also build small, working things for real people. See how I work with small businesses →