Davin Reynolds

Designed and implemented a comprehensive AWS infrastructure deployment solution for GRC compliance using Infrastructure as Code principles. Built automated compliance monitoring and reporting systems with CloudFormation templates, ensuring security-first architecture.

Developed an automated compliance monitoring system for AWS environments using Infrastructure as Code principles. Built continuous security validation, automated reporting dashboards, and real-time compliance tracking for NIST CSF and AWS Well-Architected Framework requirements.

Designed and developed a professional portfolio website showcasing GRC expertise using modern web technologies and AWS cloud services. Implemented security best practices, automated deployment pipelines, responsive design, and performance optimization for global content delivery.

Built a SOC 2 Type II GRC baseline for a patient intake API on AWS. Closed 8 compliance gaps using Terraform, enforced controls with OPA/Rego policy-as-code, automated evidence collection via GitHub Actions with Cosign signing and S3 Object Lock vault, and documented the control implementation in OSCAL mapped to NIST 800-53 Rev 5.

Provisioned a NIST 800-53 compliant AWS S3 bucket using Terraform, directly encoding four controls into infrastructure code. Built a dedicated audit log bucket, applied provider-level compliance tags across all resources, and produced machine-readable plan.json and state.json evidence files that map directly to NIST control IDs — no screenshots required.

Built a reusable Terraform module that encodes six NIST 800-53 controls into a compliance wrapper for AWS S3 and KMS. Consumers supply only business configuration — the compliance floor is hardcoded inside the module and structurally cannot be disabled. Plan-time validation blocks reject non-compliant configurations before any AWS API call is made.

Built an S3 Object Lock evidence vault and evidence capture script that packages Terraform workspace output into a tamper-evident, immutable bundle. The script SHA-256 hashes each file, records a manifest, and uploads a locked bundle to S3 — producing audit evidence with integrity, attribution, and reproducibility properties that no screenshot or PDF can match.

Built a policy-as-code library using OPA and Rego that enforces NIST 800-53 controls against Terraform plan JSON before any infrastructure is deployed. Policies are annotated with NIST METADATA blocks and ship with a three-test suite per policy covering compliant pass, wrong value fail, and missing config fail — shifting compliance left to the earliest point in the pipeline.

Wired the Lab 3.3 Rego policy library into Conftest, integrating compliance enforcement directly into the CI/CD pipeline. A policy-gate.sh wrapper evaluates all namespaces, captures JSON evidence on both pass and fail runs, and returns exit codes that block non-compliant PR merges. Includes AWS-specific policy variants using Terraform dependency graph reference matching.

Built a fully automated compliance gate running on every pull request via GitHub Actions. The pipeline authenticates to AWS using OIDC (no stored credentials), generates a Terraform plan, evaluates it against three NIST 800-53 Rego policies, runs a tfsec static security scan, and uploads a timestamped evidence artifact — all before a single resource touches AWS.

Extended the Lab 4.3 GRC pipeline with cryptographic evidence signing and immutable vault storage. Every pipeline run bundles evidence files, signs them with Cosign keyless signing using GitHub's OIDC token, and uploads the signed bundle to an S3 Object Lock vault. The chain of custody holds for both pass and fail runs, answering an auditor's hardest question with mathematical proof.

Deployed the AWS-native detective control layer using Terraform. Stood up multi-region CloudTrail with log-file validation, enabled Security Hub subscribed to NIST 800-53 Rev 5 and AWS Foundational Security Best Practices, and deployed AWS Config for continuous resource configuration recording — creating a continuously running detection layer that produces audit evidence without manual effort.

Authored OSCAL Component Definition and Profile documents using the NIST standard for machine-readable security documentation. The component definition links four NIST 800-53 Rev 5 controls to specific Terraform resources with evidence URIs pointing to signed bundles in the Object Lock vault, completing a cryptographically verifiable chain from control requirement to implementation to audit proof.