Orlando, FL · Open to remote
A control only works if people follow it, and you can prove it
I learned that on a warehouse floor before I ever learned it from a framework.
How I got here
I started at Amazon in 2020 as an associate, and from 2021 I was a Stow Process Assistant, leading daily start-ups for 60–80 associates and coaching on quality. When I moved to quality at a new site launch, our weekly SOX audit compliance sat around 63–70%. I set up structured tracking and trained associates on every shift, and within a month we were at 99% and stayed there.
That's when I learned that controls are a people problem as much as a technical one, and that I like the work of making them stick. A control that nobody follows isn't a control, and one you can't evidence may as well not exist.
What I build
I learn by building, and then by auditing what I built. Three examples, each with its own case study:
- Workspace — a SharePoint-shaped intranet that runs on three different backends, with 454 automated checks and a stored-XSS flaw I found and fixed across 60 insertion points.
- A cyber home lab — Entra ID and SharePoint governance in a live Microsoft 365 tenant, then reviewed against itself. That review is how I found the audit log had never been switched on.
- A GRC program for a business that doesn't exist — Burn and Churn Coffee, a fictional card-accepting small business, taken from asset inventory through a 15-control matrix to a POA&M.
WinSysConfig is the one without a write-up yet: a Windows settings tool that journals every change it makes, with no network listener at all. It gets its own case study once its writes and journal are pushed.
The kind of team I'm looking for
I'd especially value a team that mentors. I'm early enough in this that being taught properly is worth more to me than a title, and I'd rather be somewhere that expects questions than somewhere that assumes I have none.