Day job · sanitized
Cloud security, at scale
Cloud Security Analyst at a Fortune 500 insurer since April 2026, after its IT security rotational program (June 2024 to April 2026). Sanitized case studies: no employer name, and no environment details beyond the tool names.
- 1,100+
- GCP projects mapped to their owning application
- 46
- container controls in a RACI agreed with 3 teams
- 8
- missing service entries created so every project had an owner
- hours → minutes
- weekly security metrics reporting
Container security
In one line: I defined who owns what for container security: a RACI across 46 controls, agreed with Cloud Engineering, Networking and AppSec.
- The operating model: every container control has a team that is responsible, one that is accountable, and the teams to consult or inform, so a finding never stalls on "whose is this?".
- Remediation follow-through: when unapproved pre-hardened images were found heading toward production, I assisted with remediation management: I handled the ticket and tracked it until the fix was done.
Cloud asset governance
In one line: a finding is only actionable if it can reach an owner, so I validated 1,100+ GCP projects and linked each one to its business application in the ServiceNow CMDB.
Every cell below is one GCP project that existed with no reliable link to the business application it belonged to. Not a rounding error, not a backlog: this is the estate. A finding on any one of them had nowhere to route, because nothing recorded who owned it.
The eight lighter cells stand for the 8 Technical Service entries that did not exist and had to be created before their projects had an owner to point at. Unglamorous work, and everything below depends on it: a finding cannot route to an owner that was never written down.
Findings that arrive routed
In one line: Wiz CSPM findings now open ServiceNow tickets that already name the asset's owner and carry its context.
- Integration: Wiz findings flow into ServiceNow vulnerability ticketing, pre-filled with asset ownership and context, so remediation is tracked from the moment a finding exists.
- Intake: I co-built the ServiceNow intake process for cloud security requests, so asks reach the team in one tracked queue.
SOAR proof of concept
In one line: I evaluated two no-code SOAR platforms (Torq, Tines), built workflows that enrich a cloud vulnerability alert the moment it arrives, and presented them to leadership with an adoption roadmap.
An alert on its own says something is wrong in a project named after a number. Who owns it, how bad it is and whether it is already open is research someone does before the real work starts. Fire one and watch the payload on the right grow at every step.
what it cost
the alert, as it travels
automated · Torq
by hand · an analyst
· vs ·
Illustrative timings and a redacted resource; the shape of the workflow is the real one. Both runs end with the same payload on purpose: the workflow does nothing an analyst could not do by hand. It does it in seconds, at 3 am, for every alert, without mistyping the project id. The owner lookup in step two only works because of the mapping in case study 02.
Prevention over reaction
In one line: I recommended GCP Organization Policy constraints that block risky configurations at creation, moving recurring misconfigurations from fix-after-detection to never-created.
CSPM tells you what is already misconfigured: useful, but always after the fact. Two levers decide what one bad config costs: whether it can be created at all, and whether its finding can reach an owner. Toggle them and deploy.
Timings are illustrative; the mechanics are real. One fixed three-week scale for every scenario, so the bars compare honestly. The constraint is evaluated at creation, which is why the prevented case has no bar at all rather than a short one.
GRC, audit and reporting
- Reporting: automated the weekly security metrics report with scripts and macros, from a multi-hour manual process to minutes.
- Audit readiness: I facilitate the annual cloud control reviews; governance docs stay audit-ready through CI/CD-driven updates.
- First rotation (8 months): security risk remediation and issue tracking in ServiceNow GRC.
- Internship (2023): browser extension governance with Active Directory; risk exceptions in ServiceNow and ZenGRC.
what it demonstrates
GCP governance at scale (CMDB ownership for 1,100+ projects), CSPM operations (Wiz findings routed into ServiceNow with owner and context), SOAR evaluation (Torq, Tines), preventive controls (GCP Organization Policy), container security operating models (RACI), GRC and audit readiness, and reporting automation.