I got tired of security being an afterthought. Whether you need SOC 2 readiness or automated cloud compliance, my goal as your Cloud Security Engineer is simple: make security something you automate, not something you dread. Here's a look at the automation engines I've built to get there.
Remote / Available Globally
Honestly, most of my projects started as me jumping in where companies get stuck. As a GRC & cloud security engineer, I kept wondering — like, why does SOC 2 readiness still take months when half of audit prep is just checking boxes that a script could check?
That curiosity turned into a habit of building. The GRC engine, the incident response platform, the DevSecOps pipeline — they weren't separate ideas, they just kept connecting to each other. Now they're basically one system.
I care most about the gap between ‘we have a security policy’ and ‘our security policy is actually enforced.’ That gap is usually where I start.
NIST CSF, SOC 2 readiness, ISO 27001, HIPAA — acting as your GRC consultant to turn complex frameworks into enforceable policy-as-code.
GCP & multi-cloud security architecture, IAM hardening, network segmentation, and infrastructure-level threat mitigation.
Python-driven automation, custom detection rules, SIEM integration, and building tools that scale security operations.
Terraform, Docker, CI/CD pipeline security, IaC scanning, and embedding security into every stage of the development lifecycle.
I don't just build side projects—I build scalable solutions to real business bottlenecks. Here is how I approach solving complex security, compliance, and cloud architecture problems for the people.
Audit prep usually means an engineering team burning weeks manually going through spreadsheets. I wanted to see how much of that pain could be killed with automation. Turns out: most of it.
This engine scans 94 CIS controls, figures out what's broken in your cloud, generates the Terraform to fix it, and validates the fix before it touches production. It turns a week-long compliance nightmare into an afternoon task.
The biggest problem with incident response is the lag. By the time a human notices a GuardDuty alert, the blast radius has already grown. I built this to stop waiting for humans to react.
When an alert fires, the system instantly maps the attack path using Neo4j, automatically isolates the compromised resource, and pushes a Terraform fix—usually in under two minutes. No more frantic slack calls.
Developers shouldn't have to slow down to think about security—the pipeline should just handle it. I built this so teams can ship fast without shipping vulnerabilities.
It runs OWASP ZAP, SonarQube, and Trivy on every commit. If it finds a vulnerability, Claude on Bedrock automatically writes the fix and opens a PR. The developer just reviews and merges.
Securing GCP isn't just about checking boxes in the console—it's about understanding how components break under pressure. I spent time deliberately breaking and securing complex architectures to learn exactly how to configure enterprise environments.
It covers 20+ architectures including IAM, GKE RBAC, Cloud Armor, and KMS. The main focus was on Cloud IDS and VPC Flow Logs—watching how traffic moves and fails at that level totally reframes how you think about zero-trust and network segmentation.
Microsoft Certified: Azure Security Engineer Associate
Proving proficiency dealing with Secure Access Management, Identity Protection and Governance, Platform Protection, Securing of Applications, and managing Security Operations in Azure environments.
Deloitte Cyber Simulation (Forage)•July 2025Deloitte's SOC simulation put me inside a real-feeling incident investigation — messy logs, no obvious answers, and a clock running. The one that stuck with me most was an insider threat case where the access pattern looked completely normal until you noticed it was too consistent. Hourly API calls, no UI sessions, always the same size. That's not a person, that's a script. Narrowed the investigation scope significantly once we flagged it.
If you're building something that needs to be secure and audit-ready, let's talk. I've built the tooling — I know what it takes to actually get there.
devvjoshi2005@gmail.comRemote / Available Globally
