I spent ten years in clinical healthcare, mostly in general radiology, MRI, or CT. I understood the equipment, the workflow, and the regulatory environment well enough to function without thinking much about them.
In 2020, I was working in an ER in Bergen County, New Jersey, during COVID. At some point that year, someone started calling us "essential workers." It was meant as a compliment. What it meant in practice was that going to work was a calculated risk I was required to take. Every shift.
That year made me think seriously about the next ten.
I didn't leave healthcare. I moved to a different part of it. The infrastructure layer. The systems hospitals run on. The data pipelines that carry patient records. The access policies that determine who can read what at 2 a.m. That's still patient care. It just runs on AWS.
My clinical background matters more than I expected. I understand HIPAA as an operator, not as a compliance exercise. I've worked in environments where a breach isn't just an incident on a risk register. It's a specific person's psychiatric records, their HIV status, or their addiction treatment history. Exposed.
That context doesn't go away. When I write access policies now, I'm thinking about that. Least privilege isn't a principle I learned in a course. It's obvious when you've spent years in regulated environments where the cost of a mistake had a face.
Most engineers learn compliance as a concept. I learned it as a culture.
The transition itself was not smooth.
I had no background in software when I started. The first time I read infrastructure as code, I had no frame of reference for what I was looking at. I went back and forth on certifications versus a degree. I started courses and quit them. Then started again.
What I eventually figured out is that you can't plan your way out of not knowing things. You just have to work through more of them.
Right now, I'm building on AWS. Serverless infrastructure using Lambda, API Gateway, DynamoDB, and CloudFront. Compliance automation with Terraform and OPA. AI pipelines running on Bedrock. These are production systems I maintain and iterate on, not tutorials I followed once.
The reason I'm building them publicly is simple. The question every hiring manager asks isn't what you know. It's what you've built. I want that question to have a clear answer.
Cloud security, GRC engineering, and compliance automation are not separate tracks to me. They're the same problem viewed from different angles. I want to work with a team that sees it the same way.
Working in an ER teaches you to make decisions with incomplete information under pressure. You make the best call you can with what you have, and you adjust when more comes in.
The infrastructure is different. The job is the same.