Writing
Practical writing on AI governance, cloud risk, and building compliance programs that actually scale.
AI Governance
Most ISO 42001 guides read like a standard summary. This one doesn't — here's what the gaps look like when you're in the room doing the actual work.
GRC Engineering
Why manual evidence collection is a liability, and how I built an automated pipeline that maps SSM outputs directly to SOC 2 control evidence.
Cloud Risk
Wiz, ScoutSuite, and the tools are table stakes. The real work is building the process, escalation paths, and risk appetite that make alerts mean something.