Scott A.

vCISO, AI-Cyber specialist, and technical writer helping organizations manage AI risk and complete audits for CMMC Level 2 (NIST 800-171), SOC 2, HIPAA, NIST 800-53, and NIST AI RMF. I deliver audit-ready security architecture across AWS and Azure, practical SSP/POA&M execution, compliance automation in Drata, Vanta, and Sprinto, plus security operations visibility using Microsoft Sentinel (SIEM). I support organizations in banking and financial services, healthcare, SaaS, defense-related environments, and energy/utilities, aligning security and compliance programs to regulatory, contractual, and operational requirements. I am especially effective when engagements require both strategic leadership and detailed execution across people, process, and technology. What clients hire me for: AI Risk and AI Compliance: NIST AI RMF adoption, AI use-case inventories, AI risk assessments, control mapping, AI policy development, vendor governance, and alignment to ISO/IEC 42001 CMMC / NIST 800-171: readiness assessments, SSP/SAR/POA&M, remediation roadmaps, mock assessments, and implementation support SOC 2 (Type I/II): gap assessments, control design, evidence strategy, audit support, and continuous compliance operations HIPAA: risk analysis, safeguard mapping, policy development, vendor security documentation, and audit preparation NIST 800-53: baseline alignment, control tailoring, implementation guidance, and governance operating models Banking / Financial Services: security and compliance programs aligned to FFIEC expectations and GLBA safeguards requirements Energy / Utilities: security governance, risk management, and control support for resilience-focused environments Enterprise Security Architecture: security program architecture, control architecture, reference designs, threat modeling, and secure enterprise patterns AWS and Azure Security Architecture: cloud security posture, IAM design, network segmentation, logging and monitoring strategy, encryption and KMS, platform hardening, and audit-ready evidence models Microsoft Sentinel: SIEM architecture, log integration strategy, detection and monitoring support, incident visibility, and security operations alignment in Azure and hybrid environments Platforms and tooling: I work with compliance and audit-readiness platforms including Drata, Vanta, Sprinto, Secureframe, and Scrut for control mapping, evidence collection, remediation tracking, and ongoing compliance workflows. I also support security operations visibility using Microsoft Sentinel where monitoring and audit evidence need to align. How I engage: vCISO advisory: security leadership, compliance strategy, risk management, executive reporting, incident readiness, and continuous oversight Project-based engagements: targeted assessments, audit readiness projects, control implementation, security architecture initiatives, and documentation packages including SSPs, policies, standards, and procedures I also bring a strong background in technical writing and technical editing, which means clients receive deliverables that are accurate, clear, organized, and audit-ready. If you need a consultant who can help you manage AI risk, improve audit readiness, strengthen security architecture, and deliver documentation that supports compliance outcomes, I can help.