FedRAMP Moderate authorization
Contributed to a FedRAMP Moderate authorization covering 300+ NIST SP 800-53 controls, a third-party assessment, and continuous monitoring. The specific controls I implemented are listed under Experience.
Security & Compliance
The security and compliance work behind the DevOps title: controls implemented for a FedRAMP Moderate authorization, a SIEM built and run in-house, detection rules kept in version control, and a monthly vulnerability scanning cycle.
Self-managed OpenSearch SIEM
Tiered retention across 40+ services in a HIPAA/FedRAMP-scoped environment. Data residency ruled out a third-party SIEM. ISM policies move logs from hot SSD for 7 days to warm and compressed for 30, then snapshot to encrypted S3 for the one-year retention HIPAA requires.
Sigma detection rules
Detections are Sigma rules compiled to OpenSearch DSL with
sigma-cli and tracked in git with normal PR review, so the audit
trail for "when did we start detecting X" is just git log. Alerts
route to Slack for low severity and PagerDuty for high, through the same
Lambda-based alerting the SIEM uses. The Keycloak monitoring build below is a
side project on its own Zabbix and Google Chat pipeline, not part of this one.
Detections were tuned against real data before any dashboards were built. The lessons-learned section is candid about it: the initial detection set was noisy enough that tuning took longer than writing the rules.
Nessus vulnerability scanning
Nessus ran inside the Docker Compose stack, not against the perimeter, so a monthly scan saw what an attacker with a foothold would see. Results went to security, compliance and operations. Scope and the JMeter work alongside it are under Experience.
Frameworks & Certifications
Production
Used daily at Keel Digital.
Personal projects
Real builds, not production systems.
Working knowledge
Used or evaluated, not day to day.
Education & Certifications
- Certified Ethical Hacker (CEH) v13
- Advanced Diploma, Cybersecurity