GRC & Cybersecurity
Compliance Analyst
Active TS/SCI. Six-plus years across federal NIST 800-53 / RMF programs and commercial SOC 2 / ISO 27001. Compliance work built on four years of 24/7 operational network defense, hardened by real audits.
Hiring
Need a GRC or compliance analyst?
GRC, compliance, ISSO, or security analyst roles. Remote, or hybrid and onsite in greater Orlando. Interviewing now.
Being audited
Need to get through CMMC, SOC 2, or ISO 27001?
Readiness work, gap assessments, findings, and POA&Ms, from someone who has written the packages and answered the assessors. Project work quoted in writing after a free call.
Experience
Where the work happened
Dec 2025 · Present
AI Cybersecurity Specialist
Invisible Technologies · Contract · Remote
Red-teaming frontier LLM behavior: prompt injection defense, adversarial evaluation, and SOC/GRC scenario authoring that hardens model reasoning on incident response and control-mapping tasks.
Jun 2024 · Jan 2026
Senior Information Security Analyst
Lockheed Martin · Jacksonville, FL
Control assessments, eMASS accreditation packages, POA&M governance, and continuous monitoring on classified DoD programs. Python/PowerShell evidence automation. Splunk dashboards backing 100% audit log retention.
Sep · Nov 2023
Information Assurance Analyst
Five Stones Research Corporation · Contract
ATO sustainment across ~200 servers and ~2,000 workstations: McAfee HBSS, STIG baselines, IAVM compliance, image certification.
Apr 2019 · Jan 2023
NOC Administrator & Systems Administrator
U.S. Air Force · Ramstein AB, Germany
24/7 watch-floor defense for 3,000+ personnel across three Combatant Commands. 1,000+ Tier 1/2 incidents. Zero-day mitigation across 241 systems at 11 sites inside 24 hours, with zero rework on the follow-up audit. RHEL/Windows fleets at 99.9% uptime.
Skills
Four areas, one job: prove the controls work
Compliance & risk
Full control lifecycle: gap analysis, remediation, narrative authoring, evidence, POA&M closure.
Detection & response
Four years of shift-based ops. I know which control failed behind an alert, and what the reporting obligation is.
Compliance automation
Scripts that pull configuration evidence from cloud and endpoint sources and normalize it into audit-ready artifacts.
AI security
Active red-team practice against frontier models, the fastest-moving attack surface in the field.
Credentials
Certifications and education
Certifications
- GIAC GSEC · Security Essentials
- GIAC GFACT · Foundational Cybersecurity Technologies
- CompTIA Security+ CE (DoD 8570 IAT Level II)
- CompTIA Network+ · CompTIA A+ · ITIL 4 Foundation
- CISSP (next up)
Education
- B.S. Cybersecurity & Information Assurance, Western Governors University (expected December 2026, completed alongside full-time work)
Off the clock
The human part
Greater Orlando based. I taught open-water sailing before I ever touched a SIEM, and I still do my best thinking within sight of salt water.
Black, early, non-negotiable.
Homelab tinkering, CyberWarfare Labs challenges, and finishing a WGU degree at night. Graduation is close enough to taste.
59 days to December 2026
GRC aficionado. Yes, that is a real personality type.
Play
Three small games about audits
GRC Bingo
Twenty-four things you will hear in an audit. Tap a square when it happens.
Two minutes. Five in a row wins.
Is it a finding?
Five questions, one verdict, and a finding template in the right shape.
Answer yes or no. Copy the template.
GRC Quest
Thirty days to an assessment, a d20, and a coffee.
Pick an option. Roll high.
All eleven games, plus the CMMC checklist, are on the Play page
Contact
Hiring, or being audited?
Either way it starts with a free 15-minute call. Recruiters: I am interviewing now, remote or hybrid and onsite in greater Orlando. Clients: tell me what you are being assessed on and when.