Aaron O.

Principal Security Engineer with 20 years across DevSecOps and GRC. I help startups and scale-ups harden cloud platforms, pass audits (SOC 2, ISO 27001, GDPR), and build the security tooling (SIEM, IR, IAM, secrets, evidence pipelines) that keeps them that way. Where I add value: • ISO 27001 / SOC 2 audits & readiness. ISO 27001 Lead Auditor & Lead Implementer. I run internal audits against ISO/IEC 27001:2022 (clauses 4 to 10, Annex A), build SoAs, write findings reports auditors can take to certification, and operate inside Vanta, Drata and Secureframe. • Cloud & platform security. AWS (Security Specialty + Advanced Networking), GCP, Azure. IaC-first hardening with Terraform/CloudFormation. Wazuh, Splunk, Sentinel, AWS Security Hub, Prometheus/Grafana for detection and observability. • DevSecOps pipelines. SAST/DAST, secrets scanning, SBOMs, signed releases, evidence-based promotion gates, self-service IAM with guardrails so engineering ships without governance bottlenecks. • Infrastructure & IR ops. Active Directory, GPO, Linux/Windows server fleets, virtualization, VDI, DLP, DNS filtering, EDR, privileged-session monitoring, incident triage with clean change-control records. Industries: fintech, healthcare (HIPAA-aware, PHI handling, medical-device-adjacent), AI/ML platforms, B2B SaaS, manufacturing, defence and other regulated environments. Credentials: OSCP, CISM, CISA, AWS Security Specialty, AWS Advanced Networking Specialty, AWS DevOps Pro, ISO 27001 Lead Auditor, ISO 27001 Lead Implementer, IASME Cyber Essentials & CE+ Assessor, IASME GDPR Assessor. Calm under pressure, evidence-driven, and not shy about saying "not ready for production" when the evidence isn't there.