🛡️ RepoSentry — AI-Powered Supply Chain Security Scanner Live Product

Built to answer the question every GRC and AppSec team asks before pulling in a dependency: is this repository actually safe to use? RepoSentry runs a multi-layer risk assessment on any GitHub repo before it gets cloned into a codebase - live CVE scanning against OSV.dev, hardcoded secrets detection, AI-driven review for obfuscated code and prompt-injection payloads, agent-targeting content detection (hidden Unicode, malicious MCP configs), and author/repository due-diligence scoring (age, maintenance activity, stars).

The differentiator is evidential rigor, not just detection: every AI-reported finding must cite a real file and a verbatim snippet, which is then programmatically re-verified against the source before it's surfaced - eliminating false-positive "assurance" that plagues most scanners. Findings map directly to ISO/IEC 27001, NIST SP 800-53 and SOC 2 controls, converting ad-hoc third-party risk checks into audit-ready evidence - closing the loop between supply chain security and compliance in a way that satisfies both the engineer and the auditor.

⚖️ CGE-P Capstone — SOC 2 Compliance-as-Code: Prevent, Detect, Prove Certified GRC Engineer, Practitioner Capstone

Most GRC evidence is a screenshot someone took and hopes nobody questions. This capstone governs a PHI telehealth intake workload against SOC 2 Trust Services Criteria and produces evidence an auditor can verify by cryptography rather than by trust. A GitHub Actions pipeline plans the Terraform infrastructure and runs it through a Conftest/OPA policy library of gap-detection rules mapped to SOC 2 controls (CC6.1 access, CC6.3 least privilege, CC6.7 transmission, A1.2 availability) - blocking merges on real violations and proving it with paired pull requests, one deliberately failed and one fixed. Every applied change is signed keylessly with Cosign/Sigstore (GitHub OIDC → Fulcio certificate + public Rekor transparency-log entry) and locked in an S3 Object Lock vault, so a single verify script re-checks the whole chain and prints CHAIN INTACT - the write-up even documents a live tamper test against the vault.

The latest addition closes the other half of the control: an automated access review. A scheduled, read-only Lambda continuously audits the live account, orchestrating findings from IAM, IAM Access Analyzer and Security Hub into one report, with an Amazon Bedrock model writing the executive summary and each run landing as timestamped CSV in a versioned, encrypted bucket. Where the pipeline prevents non-compliant change at deploy time, the access review detects drift and access risk after it - engineering SOC 2 CC6.3 periodic access reviews as automation instead of a documented manual process. Prevent, detect, prove - end to end.

Terraform · AWS (Lambda, S3, EventBridge, Security Hub, IAM Access Analyzer, Bedrock) · GitHub Actions · Conftest / OPA · Cosign / Sigstore · OSCAL · SOC 2 TSC

🔗 ISMS Risk & Control Assurance Seven Client Portfolio

Owns risk assessment, control mapping and internal audit workstreams across 7 concurrent clients spanning defence supply chain, SaaS, research, nonprofit and professional services. Built a traceable evidence chain from SoA controls through to internal audit findings.

🔗 NIST SP 800-171 Gap Analysis Defence Supply Chain Manufacturer

Reviewed 110 controls against an existing SSP, producing a prioritised remediation roadmap supporting CMMC readiness.

🔗 Simple Supplier Management (SSM)

Centralises supplier records, certifications, renewal dates and risk ratings. Implements ISO/IEC 27001 controls A.5.19-A.5.22 in production. Live at a top-10 UK financial sector company.

🔗 Multi-Department Internal Audit Programmes Software & Defence Clients

Planned and led full ISO/IEC 27001:2022 internal audit programmes across multiple departments end to end, including audit plans, control matrices and CAPA tracking.