About me and background about me & background

Tell me about yourself

I’m a cloud GRC analyst who automates compliance by building custom AI tools.

I came into this from running my own business. When the pandemic hit, I realized I had been reacting to risk instead of managing it, and I wanted to work in an industry that stays resilient when the economy doesn’t.

So I went back to school, finished my BS in cyber security at WGU, and picked up my security+, Cysa+, Pentest+, and AWS cloud practitioner certifications

Since then, I’ve been building GRC tools.

• Risk Whisperer maps controls and tracks remediation.

• My Evidence collector pulls proof from GitHub and AWS every week

• And my AI registry rates AI tools by risk and lists the reviews they need.

I also did a NIST & ISO 27001 assessment at my internship at ROKS, and right now I’m advising a Fintech client on SOC 2 Type 1 readiness

Why GRC and why automation?

• I got into GRC because I learned the hard way that reacting to risk costs more than managing it and GRC is the work of managing it before something breaks

• And it’s moving toward automation, which is where I wanna be. Chasing evidence and screenshots each time that should go into real risk work, so I’d rather be spending that time building the tools that remove that burden.

Why the career change from running your own business?

My business took a hit after the pandemic, making me realize I was constantly putting out small fires instead of fireproofing the business. I wanted an industry that stays resilient, even when the economy doesn’t because security needs don’t disappear in a downturn… unlike retail.

How is your business background relevant to GRC?

In my own business, I handled regulatory, licensing, and vendor, risk, compliance, managed budgets, and vendor, contracts, complete completed annual PCI SAQs, ran IT systems, and wrote how to docs.

What are your strengths?

Building automation for compliance work, explain, technical findings in plain language, and staying organized across a lot of moving pieces

What are your weaknesses?

I haven’t used enterprise GRC platforms like Vanta, Drata, or OneTrust, hands-on yet. However, I have built my own tools, which cover the exact same workflow of controls, evidence, and auditor questions, and I’m ready to learn whichever platform the team uses.

What are you doing now?

I’m advising a Fintech client on SOC 2 type 1 readiness and building GRC automation tools while searching for a full-time role

Where do you see yourself in five years?

I see myself leading how compliance work gets automated, with the deeper expertise and credentials to match

Why not engineering?

I like building, because that’s how I learned to solve compliance problems. The work I want to do is deciding what the controls need improving they work, and the tools just make that faster.

Explain your nontraditional path or gap

My path is nontraditional, but continuous I went from running a business, to formal cyber security training, and hands-on GRC work and builds

Why AI governance?

I built risk whisper, an AI power GRC tool, and I had to govern its risks myself, from prompting injection filtering, to input validation, to verified look up tables that override AI output when it drifts.

That showed me AI needs controls like any other system, and I want to do that work full-time.

Why should we hire you?

I automate compliance by building, custom AI tools, I verify them, and I can explain the rules to non-experts. I learn by building, and I follow through. I’ve shipped three working tools. I’d put that to work from week one

Tell me about a leadership story

I lead a community program that grew basic tech meet ups into cyber security awareness sessions with hands-on lessons on phishing, passwords, and device safety. People started coming, and soon they were showing me the phishing emails and texts, they spotted on their own