About Me: From Enterprise Security to Cloud & AI Security Engineering

## How I Got Here

My start in security wasn't cloud, and it definitely wasn't glamorous. It was the enterprise trenches — network and endpoint defense, SIEMs, incident response. At a Tier 1 fiber provider I was one of two network security engineers on a small (six-person) security team: Palo Alto firewalls, threat hunting across thousands of endpoints, and Splunk dashboards I built at odd hours because the alert I needed didn't exist yet. Before that, I ran managed security for ten different client organizations at once — a fast way to learn that there's no such thing as "one way" to secure anything.

I didn't start with security at all. I started at twelve, reverse-engineering drum videos from a website's page source because I wanted the parts the site wouldn't just hand me. Open the hood, read the source, figure out how the thing actually works instead of how the manual says it works. That instinct never went away. I just eventually pointed it at IAM policies and Terraform instead of drum transcriptions.

A few years ago I joined AWS Professional Services as a security consultant, and that's where the work changed scale. Cloud, infrastructure-as-code, application and product security, DevSecOps, and some others... The shift that stuck with me was treating security as code: something you version, test, and automate, instead of a checklist somebody fills out at the end.

## What I Actually Do

The through-line across all of it: build the automation and guardrails that let teams move fast without shipping risk. That's meant 18+ projects with some of AWS's largest customers — healthcare, financial services, government, defense, education-tech, telecom, etc. Four things worth naming:

Multi-Region IPAM on AWS. 67 hierarchical pools and 874 network resources across six Regions, automated end to end in Terraform, with cross-account sharing via AWS RAM. There was no pattern to copy when I started, which is how it ended up published as AWS Prescriptive Guidance and open-sourced to aws-samples. Plus additional AWS-internal security patterns.

Cloud governance & compliance-as-code. Policy-as-code guardrails: Service Control Policies, custom AWS Config rules, Security Hub and GuardDuty, Landing Zone Accelerator baselines — the machinery that catches a regulated environment drifting out of compliance, instead of finding out on audit day.

Shift-left DevSecOps. A CI suite orchestrating 15+ scanners that only run against what actually changed, which cut CI cost 40–60% on its own. On one customer's platform it took internal security validation from two weeks down to four hours. I inherited that pipeline in a state where one tool failing killed the whole run and nobody read the output anymore — most of the work was making the results trustworthy, not adding scanners.

GenAI & agentic-AI security. OWASP LLM Top 10 reviews, Model Context Protocol and multi-agent architecture security, and 127 threats modeled and helped remediate on a FINRA-approved GenAI platform. I also built a tool that writes least-privilege IAM policies from plain English, which has been used 100+ times across seven-plus projects. I find this the most fun of the four right now.

## How I Think About the Work

A few opinions I've earned the hard way:

Security is an enabler, not a gate. The fastest way to get cut out of the room is to be the person who only ever says no. Good security makes the business outcome possible — it doesn't just make it slower.

Automate the bottleneck. If I have to solve a hard problem once, I'll solve it. If I have to solve it twice, I'll build the thing that solves it forever. Most of my best work started as me being annoyed at doing something manually. An AWS-internal review process had a year-long backlog; I wrote an analyzer for it and the backlog was gone in a week. The outcomes for that kind of thing are usually one of three — it gets adopted, it gets handed to a team that owns it properly, or it gets laughed at. All three are fine.

Document for whoever inherits it. The code is half the deliverable. The README, and the why behind a decision, are the other half — that's the part people actually thank you for six months later.

Be honest about trade-offs. Everything costs something: time, money, complexity, security. The right balance isn't the same for every team, so I'd rather put the real number on the table and let people choose.

## Beyond the Terminal

When I'm not thinking about cloud architectures, I'm usually somewhere in the Colorado mountains — hiking, skiing, or finding a reason to be outside.

Music has run alongside the security career the entire time. I'm a drummer and percussionist, and from 2015 to 2022 with Kroenke Sports & Entertainment I played in-game — mostly the Colorado Avalanche (NHL) and Denver Nuggets (NBA), with some Rapids (MLS) and Mammoth (NLL) dates, and we were on call for whatever else Kroenke put on. That turned into some things I did not see coming: the Avalanche's 2022 Stanley Cup run (Go Avs.), the NBA Global Games in London with the Nuggets, and two nights at Red Rocks — one with the funk band Lettuce, one in front of a sold-out crowd with Kacey Musgraves. I also played in a funk band, SYLVA. We put out an album, Come Alive, in 2018 and broke up in 2020.

Those are the same seven years as the security résumé. The Kroenke run started in 2015, alongside cybersecurity work-study and an HPE internship on the USPS enterprise security account; it continued through KIOSK, where I ran managed security for 10 client organizations, and through Zayo, where I was one of two network security engineers on a six-person team. It ended in 2022, the year I started at AWS. Security was the day job for all of it — the kit was the second shift.

Drumming and security turned out to have more in common than I expected. Both are pattern recognition under time pressure, and both punish you for skipping the boring fundamentals.