An infrastructure engineer who speaks compliance.
A decade inside DoD accreditation, two years auditing programs for the Inspector General, and a day job writing Terraform and running cloud security. RMF packages, POA&M programs, 800-171 and CMMC readiness — built by someone who can also implement the security the control asks for.
Federal work is where I came from, not a market I pivoted into.
Ten years across DoD security engineering and accreditation. Two of those years auditing programs for the DoD Inspector General, which means I have read a lot of packages written by people hoping nobody would read them.
That combination is the useful part. I know what an assessor is actually looking for, because I was one, and I can build the thing underneath the paperwork, because that is the job I like most. Most federal compliance shops can do one or the other.
I am also honest about what RMF gets wrong — the volume of documentation that exists to satisfy a process rather than reduce risk, and the way a control can be marked compliant with a memo instead of an engineering change. If that matters to you, the case study is worth reading.
Read the RMF case study
What I take on.
Four kinds of federal work. Most engagements are one of them, not all four.
RMF packages & POA&M programs
Control implementation statements written against the system you actually have. POA&M maintenance that survives contact with an assessor instead of being rebuilt by hand every month. Continuous monitoring that runs without a person driving it, and a body of evidence that holds together rather than contradicting itself across artifacts.
If you run eMASS, the goal is to feed it cleanly, not replace it.
Scoped per boundary
Cloud control automation
Deterministic checks against live cloud configuration — encryption at rest, logging enabled, public exposure, key rotation, privileged access — written as code and evaluated continuously instead of screenshotted once a year.
Honest about the limit: this automates the assertions, not the controls, and only the ones whose state a cloud API actually exposes. A meaningful share of any baseline is procedural and will never mechanize. I'll tell you which parts are which before you buy anything.
Scoped per environment
NIST 800-171 & CMMC readiness
System security plan, POA&M, and the implementation underneath both. Scoping the CUI boundary honestly — where most small contractors go wrong, by drawing it around the whole company instead of the systems that touch CUI. Enclave design where that is the cheaper answer.
CMMC third-party assessment requirements have been deferred and Level 1 and Level 2 can currently be met by self-assessment. What did not move: DFARS 252.204-7012, all 110 NIST 800-171 controls, DIBCAC audits, and SPRS verification before award. A suspension changed when a third party checks, not what is required — and self-attestation carries legal weight, which is the part that should concern you. See where CMMC actually stands, kept current.
Scoped per environment
Vulnerability & STIG programs
Credentialed scanning that produces findings someone can defend, STIG checklists that reflect the system rather than a default answer, and remediation tracked to closure with the evidence generated as a byproduct. Auto-POA&M came out of this work.
Foundation phase, then automated
Compliance as code, without the overclaim.
What can actually be automated, and what can't.
The unit of automation is smaller than the control
"Protection at rest is satisfied" is a judgement about an entire system. It is not mechanically decidable, and anyone selling you a tool that claims otherwise is selling you a dashboard.
"Every storage bucket in this account has default encryption enabled" is a deterministic check that answers in two seconds and is either true or false. It is evidence toward the control, not proof of it.
That distinction is why FedRAMP's newer direction defines a few dozen machine-evaluated indicators rather than trying to mechanize three hundred controls. The scope is deliberately narrower than the control, and that is what makes it work.
What I build
- Control assertions expressed as code, versioned with your infrastructure
- Continuous evaluation against live cloud configuration, not annual screenshots
- Drift detection tied to the control the drift actually affects
- Evidence generated as a byproduct of the check, not assembled before an audit
- Remediation in Terraform where the fix belongs in the infrastructure
What I won't do.
Worth saying plainly, because the incentives in this market are bad.
Not on offer
- Writing a control implementation statement that describes a system you do not have
- Marking a control compliant on the strength of a memo when the engineering was never done
- Tuning a scan so findings stop appearing in the report
- Closing a POA&M item without evidence that it actually closed
- Assessing work I performed — that is a conflict, and it is not a close call
Preparation, not assessment
I prepare organizations and build what the controls require. I am not a C3PAO and I do not conduct certification assessments. Under CMMC, an organization that consults on an environment cannot then assess it, and that separation exists for a good reason.
So I will help you get ready, and I will tell you honestly when you are not. Then somebody independent makes the call.
If passing the assessment rather than being secure is the actual goal, I am the wrong hire.
Who this tends to be for.
Small enough that there is no compliance department, serious enough that the requirement is real.
Defense contractors
Primes and subs carrying CUI with a DFARS clause in the contract and one IT generalist to satisfy it. Usually the SSP exists, the POA&M is stale, and nobody is certain the boundary is drawn correctly.
Small internal security teams
Hospitals, colleges, utilities, and municipal IT — a scanner, a compliance obligation, and a spreadsheet. Nobody in this segment is buying an enterprise GRC platform, and they are the ones an honest tool actually helps.
Assessors & advisory shops
3PAOs, RPOs, and federal consultancies producing packages repeatedly. Tooling and conversion work behind the scenes so your people spend time on judgment rather than reformatting.
What's the requirement, and when is it due?
Tell me the contract clause, the framework, or the date somebody put in front of you. I'll tell you plainly what it takes and whether the timeline is real.