Scott A.

vCISO, AI-Cyber specialist, and technical writer helping organizations manage AI risk and complete audits for CMMC Level 2 (NIST 800-171), SOC 2, HIPAA, NIST 800-53, and NIST AI RMF. I deliver audit-ready security architecture across AWS and Azure, practical SSP/POA&M execution, compliance automation in Drata, Vanta, and Sprinto, plus security operations visibility using Microsoft Sentinel (SIEM).

I support organizations in banking and financial services, healthcare, SaaS, defense-related environments, and energy/utilities, aligning security and compliance programs to regulatory, contractual, and operational requirements. I am especially effective when engagements require both strategic leadership and detailed execution across people, process, and technology.

What clients hire me for:

AI Risk and AI Compliance: NIST AI RMF adoption, AI use-case inventories, AI risk assessments, control mapping, AI policy development, vendor governance, and alignment to ISO/IEC 42001

CMMC / NIST 800-171: readiness assessments, SSP/SAR/POA&M, remediation roadmaps, mock assessments, and implementation support

SOC 2 (Type I/II): gap assessments, control design, evidence strategy, audit support, and continuous compliance operations

HIPAA: risk analysis, safeguard mapping, policy development, vendor security documentation, and audit preparation

NIST 800-53: baseline alignment, control tailoring, implementation guidance, and governance operating models

Banking / Financial Services: security and compliance programs aligned to FFIEC expectations and GLBA safeguards requirements

Energy / Utilities: security governance, risk management, and control support for resilience-focused environments

Enterprise Security Architecture: security program architecture, control architecture, reference designs, threat modeling, and secure enterprise patterns

AWS and Azure Security Architecture: cloud security posture, IAM design, network segmentation, logging and monitoring strategy, encryption and KMS, platform hardening, and audit-ready evidence models

Microsoft Sentinel: SIEM architecture, log integration strategy, detection and monitoring support, incident visibility, and security operations alignment in Azure and hybrid environments

Platforms and tooling:
I work with compliance and audit-readiness platforms including Drata, Vanta, Sprinto, Secureframe, and Scrut for control mapping, evidence collection, remediation tracking, and ongoing compliance workflows. I also support security operations visibility using Microsoft Sentinel where monitoring and audit evidence need to align.