Technology risk, GRC, and IT audit. 8 years across financial services, healthcare, and federal and DoD environments. CRISC and CTPRP certified. I'm building automation for the compliance work I used to do by hand.
I assess controls, test whether they actually operate, and write up what I find in a way the business can act on. Most of that has been in regulated environments where the evidence has to hold up to someone else's scrutiny: external auditors, federal assessors, banking regulators.
The through-line across 9 roles has been the same question in different clothes. I'm now answering it with code as well as documentation.
GRC engineering pipeline
A 6-stage build that takes AWS infrastructure from deployed to audit-defensible. Each stage feeds the next, and every control claim links to evidence an assessor can verify without asking me for it. Built between July 30 and August 17, 2026, for the GRC Engineering Club pipeline challenge. All 6 stages are complete.
Terraform provisions an S3 bucket and a segregated log bucket that enforce 5 NIST SP 800-53 Rev. 5 controls: server-side encryption by default (SC-28), public access blocked on all 4 vectors (AC-3), versioning and 4 mandatory tags through the provider default_tags block (CM-6), and access logging to the log bucket (AU-3, AU-6).
The proof is the Terraform plan captured as JSON, not screenshots. A Terraform output surfaces the encryption algorithm in effect, so the attestation can't drift from what it attests to.
3 Rego policies read the Terraform plan and return a verdict on SC-28, AC-3, and CM-6, with 6 unit tests covering the compliant and the violating case for each. The policies match resources by declared reference rather than by name, because the bucket name doesn't exist yet at plan time.
What testing caught. The first run against real infrastructure surfaced 36 false positives from a control scoped too broadly. The CM-6 tag rule was checking resources that can't carry tags, and filtering on tags_all scoped it correctly.
A GitHub Actions workflow runs the policies against the plan on every pull request and blocks the merge when a control fails. Conftest is pinned for reproducibility, the pipeline fails closed, and branch protection on main requires the check.
What testing caught. The first attempt at the blocked case passed the gate. The SC-28 rule confirmed an encryption resource existed without reading the algorithm it declared, so sse_algorithm = "none" got through. A second rule now checks the algorithm against an approved allowlist.
The workflow bundles its evidence, writes a SHA-256 sidecar, and signs the archive with Cosign keyless signing. There's no stored private key. The Sigstore certificate binds the signature to this repository and workflow, and the event is recorded in a public transparency log outside my AWS account.
Design decision. Signing runs even when the gate fails, because a run that blocked a merge is the run whose record matters most. A tamper test that appends 1 byte to the 262-byte archive fails verification immediately.
A multi-region CloudTrail writes to a private, encrypted bucket with log file validation on, producing signed hourly digest files (AU-2, AU-12, AU-10). Digests arrived from 17 regions within 20 minutes, and validate-logs returned 1/1 digest files valid. The bucket policy pins the CloudTrail service principal to this trail with an aws:SourceArn condition. Everything was torn down the same day.
Open item. RA-5 and SI-4 aren't implemented. Security Hub returns SubscriptionRequiredException on this account, so the gap is documented in the code rather than worked around.
An OSCAL component definition and profile, both validating clean against OSCAL 1.2.1. The profile selects 4 controls from the NIST SP 800-53 Rev. 5 catalog. Each implemented requirement names the Terraform resource that enforces it and links to the signed evidence bundle.
The traversal. I verified the chain the way an outside assessor would. I followed the evidence link from the OSCAL document, downloaded the bundle into a directory that had never held it, and confirmed both the hash and the signature.
The OSCAL evidence links point to a signed bundle in the repository. You can check the chain without taking my word for it. You'll need cosign and sha256sum.
git clone https://github.com/johnnyvaughanii-cyber/grc-pipeline.git
cd grc-pipeline/week-4/bundle
bash ../verify-evidence.sh evidence-bundle.tar.gz
The replay shows output recorded from verify-evidence.sh. It isn't a live run.
Scripted, full-population control testing for on-premises Active Directory, written in PowerShell and read-only without exception. Each script tests one control objective against a population extract, and a reviewer who runs the same script against the same extract reaches the same result.
This is the audit side of my work, kept in a separate repository from the engineering projects on purpose. An auditor can't independently test a control they implemented.
Logical access control objectives and test status
ID
Control objective
Status
LA-01
Access revoked timely upon separation
Complete
LA-02
Accounts attributable to an authorized individual
Complete
LA-03
Inactive accounts identified and disabled
Complete
LA-04
Privileged access requires MFA
Complete
LA-05
Credentials rotated per policy
Complete
LA-06
Privileged access appropriately segregated
Blocked
LA-07
Privileged access limited to those requiring it
Complete
LA-08
Access provisioned timely upon hire
Complete
LA-09
Shared and generic accounts governed
Complete
Against the synthetic test data, LA-01 found 24 of 91 terminated personnel (26%) still holding enabled accounts. 5 of them held privileged access, including a Backup Operators account with no MFA enrollment. The data is synthetic, and the scripts haven't been run in a live engagement yet.
12 Python tools that automate compliance tasks I've done by hand for years. Built independently and tested against synthetic data. They're functional prototypes, not production systems.
Showing all 12 tools
Access reconciliation. Compares system accounts against an HR roster and flags access that should have been removed. Tested against a 505-record synthetic dataset with a known answer key, it identified all 25 planted exceptions: 20 terminated users and 5 orphaned service accounts.
Access expiration checker. Flags overdue and due-soon access reviews, recertifications, and vendor assessments, sorted by urgency.
Access log analyzer. Parses raw authentication logs and flags after-hours access, failed logins, and privileged activity.
Control testing sample generator. Draws a reproducible random sample with a fixed seed, so a reviewer can re-create and defend the exact selection.
Control library. Tracks a control inventory with owners and last-tested dates, and flags which controls are overdue for testing.
Continuous control monitor. Runs control checks from the command line or a scheduler and writes every run, with its exception count, to a timestamped log. The expiration check is complete and the access check is next.
Findings summary. Tallies a findings register by severity for an instant Critical, High, Medium, and Low breakdown.
Findings register analyzer. Calculates finding age and groups by owner to show who's carrying the most and whose are oldest.
Findings deduplicator. Normalizes finding descriptions and removes duplicates, which matters when registers are merged across sources or assessment cycles.
Vendor risk scorer. Applies a weighted rubric to questionnaire responses and assigns a risk tier for TPRM triage.
Control crosswalk mapper. Maps NIST SP 800-53 controls to ISO 27001 and reports coverage and gaps, so overlapping framework obligations can be tested once.
API evidence puller. Pulls records from a REST API, walking pagination until the source is exhausted, and writes only the in-scope fields to a timestamped CSV per pull. Authentication is the next build.
An agent that runs a quarterly user access review and packages the result as a signed evidence bundle. Deterministic Python tools produce every count. The model routes to the right tool and writes the narrative, and every figure in the narrative appears verbatim in a tool result recorded in the manifest.
The bundle holds the tool output, a manifest with SHA-256 hashes of every input file and tool result, the full conversation record, and a checksum file covering all of it. It's archived and signed with Cosign keyless, and verification fails on a 1-byte change. Prototype on synthetic data.
Deployed from a CloudFormation template: a private S3 bucket behind a CloudFront distribution with Origin Access Control, so nothing but CloudFront can read the bucket, and HTTPS enforced. GitHub Actions deploys every push to main. The commit activity on this page is read from GitHub's public API in your browser.
I reviewed the template before running it and logged 2 gaps against my own site: encryption isn't explicitly declared, and access logging isn't enabled. Neither breaks anything, since S3 encrypts by default, but a control that isn't declared is a control an assessor can't verify.
Recent commits
Pulled from GitHub when this page loads.
Loading recent commits from GitHub
Experience
Most recent first. Open a role for the detail.
Global IS Risk and Compliance AnalystPRA Group
SOX ITGC, PCI DSS, and GDPR control evaluation at an international financial services organization. Ran recurring joiner, mover, and leaver reviews, role-based reviews, and privileged access reviews, including exception investigation and closure validation. Owned Proofpoint phishing simulations and the Power BI reporting behind them. Participated in the Change Advisory Board and assessed implementation risk.
Senior Security AnalystAzzur Group / SAP NS2
Led the NIST SP 800-53 Revision 4 to Revision 5 control and documentation update for a DoD and U.S. Army-aligned SAP cloud authorization environment. Maintained System Security Plans, FIPS 199 categorizations, privacy documentation, and evidence repositories supporting FedRAMP and RMF authorization readiness. Ran functional and tabletop incident response and disaster recovery testing with engineers and system owners.
Senior Associate, Third-Party RiskKPMG
Planned and executed 40+ global third-party technology risk assessments for financial services and healthcare clients, end to end: scoping, evidence requests, interviews, control evaluation, risk rating, reporting, remediation, and closure. Led ISO 27001 and GDPR assessments for Lloyds Banking Group. Helped establish the third-party risk program at City of Hope. Challenged incomplete evidence, unsupported control assertions, and remediation plans that didn't address the underlying requirement.
Cybersecurity Specialist IVMindPoint Group (Citizens Bank)
Recurring third- and fourth-party risk assessments using a customized NIST SP 800-53 methodology aligned to GLBA, FFIEC, COBIT, and PCI DSS. Helped transition the program from the Shared Assessments SIG to a NIST-based model and standardize evidence, risk-rating, and reporting practices.
Developed cybersecurity, cloud, and system-support procedures for a public-safety telecommunications program, translating technical requirements into controlled documentation validated with application and system owners.
IT Specialist / Security Controls AssessorParadigm
NIST SP 800-53A and 800-171 security control assessments across Windows, network, application, and cloud environments. Policy review, personnel interviews, configuration examination, and control testing. Used Tenable Nessus and Wireshark to evaluate vulnerabilities and network safeguards, and wrote the Security Assessment Reports.
Credentials and community
Certifications
CRISC, Certified in Risk and Information Systems Control, ISACA
CTPRP, Certified Third Party Risk Professional, Shared Assessments
Community
Founding president of the Hampton Roads chapter of the GRC Engineering Club, covering Norfolk, Virginia Beach, Chesapeake, Portsmouth, Suffolk, Hampton, and Newport News. Join the chapter
Frameworks
NIST SP 800-53 and 800-53A, NIST SP 800-171, RMF, FedRAMP, ISO 27001, SOX ITGC, PCI DSS, GLBA, FFIEC, COBIT, GDPR, HIPAA, HITRUST, FIPS 199, OSCAL