Compliance Engineering Platform

Live

11 labs

AWS + GCP

NIST 800-53 HIPAA OSCAL

Most compliance work is reactive. Something fails an audit, someone builds a control, and the cycle repeats. This platform was built around a different premise: compliance should be enforced at the point where infrastructure is defined, not discovered after it deploys.

Eleven labs across AWS and GCP. Policy libraries, tamper-evident evidence vaults, HIPAA gap remediation on a live patient intake API, zero long-lived credentials anywhere in the pipeline. Real cloud accounts. Real infrastructure. Real deployments.

The five systems below grew directly from that foundation. Each one solves a specific business problem. Each one has a live interactive demo.

What was built

S3 NIST 800-53 controls

Preventive and detective controls mapped to NIST 800-53 across S3 resources with automated policy enforcement.

GCP Terraform module with CMEK

Customer-managed encryption keys enforced across GCP resources via reusable Terraform module.

S3 Object Lock evidence vault

Tamper-evident compliance artifact storage with WORM protection and retention policy enforcement.

Rego policy library

Modular OPA/Rego policies covering S3, IAM, and network resources mapped to NIST and HIPAA control frameworks.

Conftest policy gate

Pre-deployment IaC evaluation that blocks violations before any resource reaches a live environment.

GitHub Actions evidence pipeline with OIDC

Fully automated evidence collection triggered on every deploy. Zero long-lived credentials throughout.

Cosign keyless signing

Cryptographic signing of every compliance artifact with a verifiable timestamp and identity claim.

CloudTrail, Config, and Security Hub baseline

Continuous compliance monitoring across the AWS environment. Configuration drift detected in real time.

GCP Workload Identity Federation and Data Access logs

Long-lived GCP credentials eliminated. All access authenticated via workload identity with a full audit trail.

OSCAL with trestle

Machine-readable compliance documentation in OSCAL format, accepted by major audit frameworks.

HIPAA gap remediation capstone

Live patient intake API. 14 HIPAA Security Rule control gaps identified and closed before audit.

Five production systems

Each system below is active and interactive. Click through to see the business problem it solves, run a live demo against real infrastructure, and read the changelog.

Compliance guardrails pipelineLive

↗

Policy-as-code gates that block misconfigured infrastructure before it reaches production. Submit a real template and watch the violation get caught against your NIST 800-53 policy set.

→Eliminated 2-4 day manual security review from every release cycle

→94% reduction in policy violations reaching production

OPA / RegoConftestGitHub ActionsLambdaAPI GatewayDynamoDB

Automated audit evidence pipelineLive

↗

Audit preparation automated end to end. Every compliance artifact is cryptographically signed, timestamped, and stored in a tamper-evident vault. Trigger a collection run and watch it execute.

→Audit prep reduced from 3 weeks manual to automated same-day collection

→Zero long-lived credentials — OIDC authentication throughout

S3 Object LockOIDCCosignOSCALGitHub ActionsLambda

HIPAA gap remediation engineLive

↗

Automated HIPAA control gap identification and remediation. Submit a sample healthcare API configuration and watch it get scanned, gaps flagged, and remediation fire. Built by someone who has worked in the environments this protects.

→14 HIPAA control gaps identified and closed before audit findings

→PHI exposure attempts blocked before any resource goes public

MacieSCPLambdaSecurity HubCloudTrailHIPAA

Cloud security baseline automationLive

↗

Continuous compliance monitoring replacing point-in-time security reviews. Live feed of configuration drift events detected and routed automatically. GuardDuty findings enriched without manual triage.

→Mean time to detect configuration drift dropped from weeks to under 2 hours

→45 minutes of manual triage per incident eliminated

GuardDutyCloudTrailConfigSecurity HubEventBridgeLambda

Zero trust credential eliminationLive

↗

Long-lived credentials replaced with workload identity federation across AWS and GCP. Submit an access request and watch it evaluated against identity policy in real time. Every decision logged.

→Credential exposure risk eliminated across the entire CI/CD pipeline

→Every access decision logged and auditable at the individual request level

OIDCGCP WIFIAMCosignGitHub ActionsCloudTrail