01
Third-Party Risk Management Orchestrator
Serverless AWS prototype that accepts vendor intake through Slack, applies configurable and explainable risk scoring, stores assessments in DynamoDB, and routes high-risk vendors to human review.
GRC ENGINEER × AI GOVERNANCE × BUILDER39.7392° N / 104.9903° W
Joshua, in Hebrew
GRC engineer building secure, auditable systems that turn complex risk into decisive action.
Credential 01CISSPCybersecurity leadership
Credentials 02 / 03ISO LEAD AUDITORISO 27001 + ISO 42001
1,000+IDENTITIES PROVISIONED2022 ACTIVE DIRECTORY LAB ↓
3FOUNDATIONAL LABS
2SAAS PRODUCTS IN BUILD
—TOTAL VISITS
[ 01 / SELECTED WORK ]
Systems built. Problems decoded.
Recent public engineering evidence leads this portfolio, followed by completed security labs and early-stage product work.
[ PUBLIC ENGINEERING EVIDENCE ]
RECENT / OPEN REPOSITORIESVIEW REPOSITORY ↗
02
HITRUST Continuous Evidence Vault
Terraform lab provisioning an immutable, encrypted AWS S3 evidence vault with Object Lock, KMS, control mapping, and runtime evidence requirements for HITRUST-aligned assurance.
03
GRC Engineering Lab
Working repository that turns Terraform deployments into verifiable audit evidence through compliant S3 primitives, automated capture, SHA-256 manifests, and immutable storage.
[ FOUNDATIONAL SECURITY LABS ]
COMPLETED / 202204
Azure SIEM Attack Map
Created a cloud SIEM, integrated Azure telemetry, and wrote KQL detections to map the origin of live attacks.
COMPLETE
05
Phishing Capstone
Built a controlled social-engineering simulation to demonstrate credential-capture risk and the human layer of security.
COMPLETE
06
Enterprise Active Directory Lab
Configured a Windows Server environment and automated more than 1,000 user accounts with PowerShell.
COMPLETE
[ CURRENTLY BUILDING ]
EARLY-STAGE PRODUCT WORKKorvus
Building a security-first SaaS platform at the intersection of governance, assurance, and intelligent workflows.
IN DEVELOPMENT
Kairos
Developing a fintech platform designed around clarity, trust, and responsible financial infrastructure.
IN DEVELOPMENT
[ 02 / OPERATING SYSTEM ]
Risk understood. Controls engineered.
GRC engineering
Designing controls, evidence workflows, and governance systems that teams can actually operate.
Cloud security
Building detection workflows and investigating hostile activity across Azure environments.
Audit & assurance
Assessing controls through ISO 27001, ISO 42001, and industry practice.
Technical execution
Moving comfortably between KQL, PowerShell automation, identity, and infrastructure.
AZUREKQLPOWERSHELLSIEMACTIVE DIRECTORYISO 27001ISO 42001RISKAUDIT
[ 03 / CREDENTIAL VAULT ]
Knowledge, independently verified.
01
CISSP
Certified Information Systems Security Professional
02
ISO 27001
Certified Lead Auditor · Certified Internal Auditor
03
ISO 42001
Certified Lead Auditor · AI Management Systems
04
SSCP
ISC2 Systems Security Certified Practitioner
05
CompTIA
Security+ · PenTest+ · Network+ · A+ · Project+
06
ITIL 4
AXELOS IT Service Management
[ 04 / ABOUT JOSH ]
Hi, I'm Josh.
I'm a cybersecurity professional focused on information assurance. I began my career in incident response, identity and access management, systems administration, and audit support. That foundation led me toward GRC and eventually to Lead Auditor credentials across ISO 42001, ISO 27001, and ISO 27701. Today, I'm building compliance automation with AI tools.
Outside work, I like finding favorite restaurants with my wife, playing basketball, and lifting. I'm a try-hard at Battlefront 2, Battlefield 6, and Call of Duty, and I try to live by "work hard, play hard." Current goals: improve at golf, become a stronger swimmer and runner, and dunk on a 10-foot rim.
BASKETBALLLIFTINGGAMINGGOLFSWIMMINGRUNNING