Security & Compliance

Security that shapes the architecture from the start: identity, least privilege, audit trails, and clear boundaries for sensitive data. Designed to hold up under HIPAA, SOC 2, and ISO 27001 review.

IAM & OIDCHIPAASOC 2Policy as codeSupply chain securityData boundaries

Industries

What it covers

Workload identity federation and least-privilege IAM

SSO-based human access with scoped permission sets

Kubernetes admission policy, digest-pinned images, and default-deny networking

PHI and sensitive-data segmentation, including in-environment processing when data cannot leave

Audit logging and evidence produced by the system, not assembled before an audit

Automated discovery and triage of security issues

Typical work

Security architecture for products entering HIPAA, SOC 2, or ISO 27001 review

Access model redesigns: SSO, federated identity, and no long-lived credentials

Security issue discovery and triage across infrastructure, APIs, and mobile apps

Data boundary designs that keep sensitive records in place

How I think about it

A security review at the end of a project finds problems that are expensive to fix. I make the security decisions with the architecture: where records live, who can reach them, how access is granted and revoked, and what evidence the system leaves behind.

Other expertise

Agentic Engineering

Coding agents as part of the engineering system. Harnesses, guardrails, quality gates, and telemetry.

Automation & Applied AI

Manual work mapped and measured, then automated where it pays off. Models chosen on evals and cost, with guardrails.

Platform & Infrastructure

AWS and GCP platforms defined in code. Kubernetes, GitOps delivery, observability, and cost control.

Data Engineering

Ingestion, enrichment, and event pipelines. Data modeled and accessible for products, analysis, and automation.

Product Engineering

Web, mobile, and backend products from first version through launch and iteration. Full stack, from data model to interface.