Most compliance portfolios are PDFs. Screenshots of dashboards. GitHub repos with a README and a few Terraform files. Nobody can run them. Nobody can see them work. You have to take the engineer's word for it.
I wanted something different.
The Origin
I completed 11 labs through the GRC Engineering Club program. The work was real: S3 NIST 800-53 controls, an S3 Object Lock evidence vault, a Rego policy library, a Conftest policy gate, GitHub Actions with OIDC, Cosign keyless signing, a CloudTrail and Security Hub baseline, GCP Workload Identity Federation, OSCAL documentation, and HIPAA gap remediation on a live patient intake API.
Good labs. Real infrastructure. Real cloud accounts. But a lab completion is not a portfolio. It is proof you followed instructions. I needed to show what I could build when nobody was giving instructions.
So I kept building.
What I Built
The Compliance Engineering Platform is five production systems that grew out of those 11 labs. Each one solves a specific business problem. Each one has a live interactive demo at chamb.dev.
Compliance Guardrails Pipeline
The problem: misconfigured infrastructure reaching production. An S3 bucket with a public ACL, an IAM role with wildcard permissions, a security group open to the entire internet. These happen every day. Manual security reviews catch some of them but add days to every release cycle and still miss things.
What I built: OPA/Rego policies evaluated by Conftest on every pull request. Any infrastructure configuration that violates a NIST 800-53 control blocks the merge automatically. The engineer gets a report: which rule fired, which resource, the severity, the control reference. No manual review required.
The demo: three misconfigured templates. Click one, click run, watch the policy engine catch it in real time.
Automated Audit Evidence Pipeline
The problem: audit preparation costs weeks of manual work. Teams gather screenshots, export logs, and assemble evidence packages by hand. Then an auditor asks for something that was not collected.
What I built: an automated pipeline that collects compliance artifacts on every deployment, signs them with Cosign keyless signing, and writes them to an S3 Object Lock vault with a 7-year retention policy. Every artifact has a verifiable signature and a Rekor transparency log entry. Auditors get a link, not a spreadsheet.
The demo: trigger a collection run and watch an artifact get collected, signed, and vaulted. Then verify an artifact and watch the Cosign signature get checked against the Rekor log.
HIPAA Gap Remediation Engine
The problem: healthcare organizations do not know where all their PHI lives. Developers create buckets, export reports, and protected health information ends up scattered across dozens of resources. Auditors find it. Fines follow.
What I built: Amazon Macie scanning continuously for PHI patterns. Service Control Policies blocking public exposure at the AWS API level before it occurs. A Lambda that auto-remediates high-severity findings in under 60 seconds with no human intervention. CloudTrail and Object Lock for the complete audit trail.
This one is personal. I spent over a decade in radiology, MRI, CT, and emergency departments. I have handled the data these controls protect every day. PHI is not an abstract compliance concept. It is a patient's cancer diagnosis, a psychiatric history, an HIV status. The controls exist to protect that.
Cloud Security Baseline Automation
The problem: quarterly security reviews tell you what your environment looked like on one day, four times a year. Everything in between is invisible.
What I built: GuardDuty, AWS Config, and Security Hub running continuously. Every configuration drift event detected, enriched with resource owner context via Lambda, and routed automatically. The security posture of the environment is visible in real time.
Zero Trust Credential Elimination
The problem: long-lived credentials. An access key stored in a repository or left unrotated is a breach waiting to happen. The credential does not expire. The attacker has unlimited time.
What I built: OIDC and GCP Workload Identity Federation replacing every long-lived credential across the AWS and GCP pipeline. Each workflow run gets a short-lived token scoped to the minimum required permissions. When the run ends, the credentials expire. There are no keys to rotate, leak, or revoke.
Why Live Demos
Anyone can write about building a compliance pipeline. I wanted hiring managers and collaborators to be able to run it themselves.
Every project page at chamb.dev has an interactive demo. The visitor clicks a button, something runs in my AWS account, and the result renders on screen. The Lambda invocation is in CloudWatch. The DynamoDB record exists. The evaluation happened.
That is the difference between a portfolio and evidence.
What Is Next
Three GRC-specific projects are in build: a vendor risk assessment pipeline, a policy and control management system, and a continuous control monitoring dashboard. Each one targets the specific skills GRC roles test in interviews.
The platform is live at https://chamb.dev/projects/compliance-platform.html