Portfolio
Selected engagements.
Clients aren't named — that's the arrangement. The problems, the approach, and the outcomes are exactly as they happened. Redacted sample deliverables are available on request.
Governance · program build
A security program built from nothing for a growing company
A company had grown past the point where security ran on trust — the tools and budget existed, but nothing tied them to a decision anyone could defend.
The problem
Vendor reviews were ad hoc, policies predated the systems they governed, and answering “are we covered?” took a week of manual work.
What I did
Designed the vendor intake and review process, wrote the policy set, and built a control-coverage model combining NIST CSF 2.0, CIS Controls, and the Cyber Defense Matrix.
Result
A repeatable process the team could run without me, and a coverage view leadership could read in one page.
NIST CSF 2.0CIS ControlsVendor risk
Security · readiness
Getting a company through a cyber-insurance renewal
A renewal questionnaire arrived with real technical requirements attached, and the honest answers would have raised the premium or lost the coverage outright.
The problem
MFA was inconsistent, backups had never been tested, and nobody could say who had access to what — exactly what the insurer was asking about.
What I did
Triaged the gaps by what the insurer actually weighted, closed the quick wins, documented the rest honestly, and mapped the answers to CIS Controls.
Result
A renewal completed accurately without overstating anything, plus a short roadmap for the gaps that couldn't be closed in time.
Cyber insuranceCIS ControlsRisk triage
Governance · policy
Fifteen policies, redlined and mapped
An enterprise IT security policy suite that had drifted out of alignment with both the current environment and any recognizable framework.
The problem
Fifteen policies, inconsistent language, overlapping requirements, and no mapping an auditor would recognize.
What I did
Policy-by-policy redline with the rationale for every change, then a clause-level mapping of the whole suite to NIST CSF 2.0.
Result
A defensible suite plus a mapping table that answers audit questions directly instead of starting a research project.
Policy draftingNIST CSF mappingAudit readiness
AI · build
An agent that reads policies so nobody else has to
Vendor security reviews meant reading long documents against a control set by hand, every time, with quality depending on who was assigned.
The problem
Slow, inconsistent, unscalable. Two reviewers could reach different conclusions on the same document.
What I did
Built a retrieval-based agent that analyzes documents against a control set, flags gaps, and cites the exact passage behind every finding.
Result
First-pass reviews in minutes with citations, so a person reviews reasoning instead of starting from a blank page.
Retrieval-augmentedCited outputsSelf-hosted
Web · nonprofit
A governance and transparency site for a nonprofit board
A 501(c)(3) needed to publish financials, governance structure, meeting minutes, and organizational documents where members could find them.
The problem
Records existed but were scattered, and members had no clear way to see what they were entitled to review.
What I did
Researched the applicable state disclosure statute, drafted the data protection and records policies, then built the public site around them.
Result
One page answering the questions members were actually asking, with the underlying policy work done properly rather than retrofitted.
Records law researchPolicy draftingStatic site
Web · application
A scheduling tool for recurring events
Organizers were managing rotating pools of people across recurring events in a spreadsheet that broke whenever someone dropped out.
The problem
Manual reshuffling, no visibility into who had been scheduled recently, constant double-booking.
What I did
Built a web app that manages the pools, builds balanced lineups across a series, and handles substitutions without a rebuild.
Result
Scheduling that took an evening now takes a few minutes, and the rotation is actually fair.
Web appScheduling logicHanded off