Skill Tree
Six years of allocated points. Main spec: GRC. Off-spec: operations. The build is deliberate.
Main specialization
GRC & compliance
Federal frameworks
Daily-driver frameworks from four years of DoD programs. Assessed, not just studied.
Commercial frameworks
Commercial attestation work: SOC 2 program operations end to end, ISO alignment, trust reviews.
Control lifecycle
The full loop, repeatedly shipped: gap analysis → remediation planning → narratives → evidence → POA&M closure.
GRC automation
The multiplier skill: evidence collection as code instead of screenshots-in-folders.
Framework depth
Six frameworks, one scale
- 5Wrote the package and defended it to the assessors. SOC 2, CMMC 2.0, NIST CSF.
- 4Implemented end to end on a real program, full control lifecycle. NIST 800-53, RMF, ISO 27001.
- 3Worked it regularly, not the whole lifecycle.
- 2Studied and mapped, limited hands-on.
- 1Familiar.
Self-rated, October 2026. The scale is mine; the evidence is on the resume and in the writing.
Second specialization
Security operations
Detection & response
Four years on a 24/7 watch floor. 1,000+ incidents from first alert to closed ticket.
Infrastructure
The systems the controls protect: administered at 99.9% uptime on classified networks.
Newest branch
AI security
LLM red teaming
Current daily work at Invisible Technologies: breaking frontier models to make them safer.
AI governance
Where the tree grows next: mapping AI risk into the control frameworks enterprises already run.
Up next
Up next
- B.S. Cybersecurity & IA, WGU (December 2026, on schedule)
- CISSP (next up, see the CISSP battle plan)
- CyberWarfare Labs SOC challenges (SO-NET-01 complete)
- Helm time (restored whenever the Atlantic cooperates)