Work
Case studies from GRC, IT, and client work — tagged by who each one speaks to most.
For employers 5
GRC, compliance, and IT work — each one marks what's verified and what isn't.
GRC Security Program
A full security program for a fictional coffee shop: risk register, 15 NIST 800-53 controls crosswalked to PCI DSS 4.0.1, an evidence pack with automated checks, a vendor risk assessment, and quarterly access reviews.
Workspace intranet
A data-driven intranet that runs identically from memory, the browser, or a real Microsoft 365 tenant — live-tenant verified, a stored XSS found and fixed across 60 sinks, 454 automated checks.
Cyber Home Lab
Entra ID and SharePoint governance built in a real Microsoft 365 tenant — then reviewed against itself, which is how I found that the audit log had never been turned on.
Home EDR
Scheduled PowerShell monitoring that started on my own PC, moved to a dedicated VM for clean evidence collection, and grew into a NIST 800-53 control-evidence pipeline, a 20-script incident-triage toolkit, and a 13-document playbook series.
STIG and 800-171 labs
Two complementary Windows 10 labs: a broad automated SCAP baseline scan, and a small set of DISA STIG controls implemented and validated by hand with exported evidence, both mapped to NIST SP 800-171.
Client work 1
Built and delivered for a real client, with their permission.