I was a sworn officer for years, using public safety technology in the field. Then I did Identity Governance at a financial services company: privileged access monitoring, user access reviews, RBAC analysis. Now I do product support at a FedRAMP High public safety software company, and I build the compliance tooling for systems like the ones I used in the field.

I write open-source Python and AWS tools for evidence collection, continuous monitoring, policy-as-code, and compliance-as-code. Mapped to SOC 2, ISO 27001:2022, NIST 800-53 Rev 5, FedRAMP High, and CJIS v6.1. I build with AI agent workflows and MCP integrations: one model writes the code, a separate model audits the diff before anything gets committed.

Open to: GRC Engineer | Security Compliance Engineer | Identity Governance Engineer | Compliance Data Engineer

Frameworks: SOC 2 | ISO 27001:2022 | NIST 800-53 Rev 5 | FedRAMP High | CJIS Security Policy v6.1 | NIST CSF 2.0

Certifications: CGE-P | SSCP | CySA+ | PenTest+ | Security+

Open-source work across commercial and federal control sets. The diagram is the federal pipeline: audit tools feeding monitoring and evidence. The commercial work runs on a separate track, where the questionnaire responder answers from the crosswalk's corpus.

graph LR
    A[Audit tools<br/>detect findings] --> B[Config monitor<br/>watches drift]
    B --> C[Remediation<br/>fixes violations]
    A --> D[Evidence logger<br/>collects records]
    D --> E[Compliance report<br/>visualizes]
    D --> F[Evidence warehouse<br/>dbt completeness]
    D --> G[OSCAL pipeline<br/>machine-readable SAR]

Seven leads. Three federal, three commercial, and one that sits across both. The commercial three are one arc: own the corpus, answer as the vendor, assess as the customer.

• Evidence Warehouse: The layer after the audit scripts. Raw findings land in DuckDB. dbt stages them into a queryable model and tests that the population is complete. Fail loud. Lineage from API call to finding. v1.0 shipped 2026-08-12.
• OSCAL Evidence Pipeline: I take audit tool output and turn it into OSCAL Assessment Results JSON. IBM Compliance Trestle handles the model work. Target shape: FedRAMP 20x machine-readable evidence.
• AWS Compliance as Code: SCPs deny the non-compliant action at the org. CloudFormation lays down a baseline that is compliant by default: CloudTrail, IAM, KMS, Config, GuardDuty, Security Hub. Preventive guardrails at the org level, detective layers in the account.
• SOC 2 / ISO 27001 / NIST Crosswalk: One mappings.yaml. SOC 2 Common Criteria as the pivot, with NIST 800-53 Rev 5 and ISO 27001:2022 Annex A hung off each criterion and a Strong/Partial/Contextual label. build_crosswalk.py emits Markdown, JSON, and CSV. --check fails on drift.
• Security Questionnaire Responder: Drafts grounded answers from that same corpus, with an inline citation and a confidence tier. When coverage is missing it returns INSUFFICIENT_COVERAGE instead of a plausible guess.
• Vendor Security Due Diligence: score_vendor.py runs two axes against a CC9.2 / ISO A.5.19-A.5.23 checklist: the data-handling profile sets inherent risk, the weighted checklist sets assurance, and a matrix resolves the residual tier. Writes a memo for the decision and JSON you can diff at annual re-review.
• IAM Access Review: A user access review as a data pipeline. Six identity extracts land in SQLite, get reconciled against HR as the population of record, and run through SQL control checks: terminated-but-active, orphaned, dormant, ownerless groups, direct assignments. A recursive CTE flattens nested groups so privileged reach is the effective answer, not the direct-membership one. Emits an evidence packet with SHA-256 input hashes that regenerates byte-identical. Stdlib only. v1.0 shipped 2026-08-23.

• NIST 800-53 Rev 5 to AWS Mapping: 31 controls mapped to AWS services as an OSCAL Component Definition. Generator filters to FedRAMP High and calls out where CJIS v6.1 pushes past that baseline.
• CJIS-FedRAMP Gap Analysis: FedRAMP High is not CJIS. Encoded where v6.x is stricter and where CJIS-only controls have no FedRAMP High home. Output is an OSCAL overlay.
• CGE-P Capstone: Graded CGE-P capstone, CMMC Level 2 mapped to NIST 800-171 Rev 3. I inherited an app with eight named gaps and wrapped it in four governance layers without touching the application: a Terraform baseline, an OPA suite that blocks regressions at the pull request, a pipeline that signs and vaults evidence on merge, and an OSCAL component definition an assessor can follow from control claim to signed artifact. Built to the exam spec and independently assessed.

• AWS Config Compliance Monitor: Config rules fire. Lambda remediates. SSM runs the playbook. Continuous monitoring (CA-7), with FedRAMP 20x KSI tracking in mind.
• AWS GRC Terraform Modules: Reusable Terraform modules for FedRAMP High and CJIS v6.1 baselines, with OPA/Rego tests and tfsec/checkov CI gates. Companion to the AWS Fundamentals Labs on luigicarpio.dev/blog.

• IAM Audit: MFA, access key rotation, credential hygiene.
• S3 Audit: Encryption, public access, versioning.
• Security Group Audit: Overly permissive inbound rules.
• CloudTrail Audit: Root usage, failed API calls, sensitive IAM / SG / Trail / S3 changes.
• Evidence Logger: Timestamped evidence files from compliance checks.
• Compliance Report: Pass/fail summaries from aggregated check data.

• Policy Checker: IAM policy scan for overly permissive configs and CJIS v6.1 violations.
• Secret Scanner: Usual secrets plus CJI identifiers (ORI, NCIC, FBI numbers, State IDs). Non-zero exit for CI. First adapter into the OSCAL pipeline.

• SQL for audit-evidence pipelines: dbt + DuckDB completeness and reconciliation tests in the evidence warehouse
• Terraform modules for compliant AWS resources (S3, EBS encryption baselines)
• OPA / Rego for plan-time policy gates on IaC
• OSCAL authoring (Assessment Results / SAR) for machine-readable evidence

Portfolio | LinkedIn | Medium | HackTheBox