All Projects

An eight stage AI pipeline. It maps FedRAMP 20x controls to a client's actual tech stack, finds the gaps against live Vanta test data, writes the remediation plan, and uploads the whole Epic, Task, and Subtask hierarchy to Jira.

A FastAPI RAG service that improves answer precision with a two-stage retrieve-then-rerank design: dense vector search fetches candidates, a cross-encoder re-scores them, and only the top results are passed to the LLM — with citations and a strict no-context guard.

An MCP server that exposes Jira operations as tools the LLM can actually call. Search issues, create them, update them, transition them, drop comments. Not just suggest what to do. Do it.

A data pipeline that takes raw cloud inventory exports and Tenable scan data and turns it into a FedRAMP Appendix M workbook you can actually submit.

A layered prompt and validation architecture that keeps LLMs from hallucinating in compliance evidence work. Structured inputs, hard constraint gates, four phases of validation.

A high level architecture diagram of the compliance automation platform. Orchestration layer, DI, strategy based backend execution, logic pipelines, adapter protocols, and external provider integrations, all laid out.

An AI platform that handles the grinding parts of FedRAMP documentation and evidence work. Control mapping, evidence narratives, AWS CLI evidence commands, appendix planning, inventory reports. The stuff that used to take weeks.

A library of reusable Claude agent skills (SKILL.md) for FedRAMP readiness — service capability profiling, control-coverage mapping, evidence collection — plus AWS and Jira integrations, packaged as an installable toolkit.

Implements the NIST OSCAL profile-resolution pipeline for FedRAMP 20X, transforming consolidated rules into machine-readable OSCAL catalogs and resolved profiles. CLI + Python API with Rev5-to-20X migration helpers and JSON-schema validation.

Evaluates an Azure tenant's security baseline across identity, governance, logging, network, and compliance domains, emitting OSCAL findings (SAR / POA&M) via pluggable Python, OPA/Rego, and ML evaluators for a pre-deployment compliance gate.

AWS-based retrieval-augmented system for policy and procedures analysis, with environment-separated infrastructure-as-code (non-prod / prod), Bedrock + OpenSearch retrieval, and smoke tests for AWS connectivity.

Orchestrates Claude agent skills to generate red-team tabletop runbooks and presentation decks from engagement input, with a CI/CD setup (pytest, scheduled runs via GitHub OIDC).

Multi-module system that generates OSCAL-compliant System Security Plans by extracting data from Vanta and applying RAG document processing — metadata, system implementation, control mappings, parameter generation, and Word export.

Maps control parts to the cloud services that implement them, using a multi stage LLM workflow with extraction and triage passes.

Generates and validates read only AWS CLI commands for gathering evidence against NIST 800-53 control parts.

Closed loop refinement system. Polls Google Doc comments via the Docs API, classifies relevance with GPT, generates refined replacements, and validates the rewrites through a verification pass before applying batchUpdate edits. Client review becomes automated revisions.

Generates FedRAMP Privacy Plan deliverables across the NIST 800-53 Rev5 Privacy baseline. It flattens nested compliance domains into tabular DataFrames with index based JSON enrichment (O(1) lookups by control ID) for moderate baseline cross references.

Two phase SCRM Plan generator with a dedicated OpenAI Assistant per domain. Hard constraint prompts ("Do NOT add, delete, reorder…") and vector store scoped retrieval grounding for FedRAMP Rev5 supply chain controls.

Three phase IRP generator built on OpenAI Assistants. Strict placeholder only fill, extractive QA with an explicit "Not found in the provided content" fallback, and a copy edit only second phase that enforces zero content changes.

Four pass compliance document refinement pipeline. Draft, then file search refine, then RF Score 1 to 5 rubric rewrite, then merge with existing procedures. Checkpoint and resume, prompt redaction, and per control part state persisted between runs.

First generation component mapper, per control part. Built on OpenAI Assistants with Vector Stores (file_search plus code_interpreter), with a relaxed fallback prompt variant and a rolled up summary pass feeding downstream document generation.

LLM powered audit question synthesis using a two pass generator and critic loop (synthesize, then refine) over NIST 800-53 control objectives. Output is structured assessment questions compliance reviewers can actually use.

Splits NIST 800-53 Rev5 baselines into low, moderate, and high JSON artifacts. Parses objectives (a., b., (a), (b)) into structured parts using regex driven custom sort keys that keep the enhancement and part hierarchy intact (AC-2, AC-2(1), AC-2(1)(a)).

Python service over JupiterOne's GraphQL API. Cursor pagination at limit 5000, a one to four query dispatcher, and the full bulk persister synchronization job lifecycle (create, upload, delete, finalize) for moving security graph data at scale.