About

I work on a cloud security team at a large company, across AWS and GCP. I care most about whether security controls actually get used. A control only works if teams can adopt it, so I put as much effort into making controls easy to use and understand as I do into building them.

I write custom security policies in Rego that check cloud settings, infrastructure code, and leaked secrets. I also keep a personal library of Checkov policies that catch Terraform mistakes the standard rules miss. Every policy I write comes with examples that pass and examples that fail, so people can see exactly what it checks before it starts blocking their builds.

I also build reusable pipeline templates that include SBOM generation and secret scanning by default. That way teams get these checks automatically instead of building their own. I handle the rollout too, from writing change requests and business cases to keeping stakeholders informed until the templates move from beta to production.