About

Cloud Security Engineer - AWS Kubernetes Compliance Automation

I harden AWS and EKS in production and map compliance requirements (SOC 2, ISO 27001, CMMC) into policy-as-code enforced in CI/CD. Day to day, in regulated cloud environments: IAM least-privilege, Kubernetes RBAC hardening, detection/triage/response on CrowdStrike Falcon and GuardDuty, and Terraform/Pulumi security controls.

Professional work is under @oliveratprimer - AWS/EKS security automation, CrowdStrike Falcon operations, GuardDuty detection workflows, and SOC 2 / ISO 27001 / CMMC audit readiness. This account is my public portfolio and writing.

---

Projects

• secure-iam-lint - CI-ready linter for AWS IAM policies; flags privilege-escalation paths and wildcard grants before they merge.
• iam-safe-defaults - Pulumi component library for AWS IAM with safe defaults that fail loud: mandatory permissions boundary, no wildcard trust, every opt-out explicit. Design rationale: IAM Roles That Fail Loud
• eks-rbac-audit - Kubernetes RBAC escalation auditor for EKS (in design) - the K8s counterpart to secure-iam-lint.
• devsecops-notes - Source for rivassec.com: Pelican, with link-check, accessibility (pa11y), and gitleaks CI.
• weaponization-threat-model - One-page addendum to STRIDE/LINDDUN/PASTA for modeling the case where the legitimate operator of the system becomes the adversary.
• cf-token-links - Token-based redirect microservice with expiration and usage limits (Flask).
• elasticsearch-tools - Minimal-privilege Elasticsearch snapshot verification with Prometheus-style metrics.
• efi-bruteforce - Archival research (2013): Teensy-based USB HID brute force of MacBook EFI passwords, featured on Hackaday.

---

Writing - rivassec.com

Field notes on IAM, Kubernetes, detection/IR, and security automation. Latest:

• IAM Blast Radius Is an Architecture Problem, Not a Policy Problem
• The Discovery Layer Is Broken: Hiring as an Observability Problem
• Prompt Injection Will Become a Supply Chain Evasion Technique

---

Toolbox

• Cloud & IaC: AWS (EKS, IAM, Organizations), Pulumi, Terraform, CloudFormation
• Security: IAM/RBAC least privilege, Zero Trust, CIS Benchmarks, FIPS
• Detection & Response: CrowdStrike Falcon, GuardDuty
• Compliance: SOC 2, ISO 27001, CMMC, FedRAMP - policy-as-code pipelines
• Pipeline: GitHub Actions, Trivy, Checkov, Bandit, Vault
• Observability: Prometheus, Grafana
• Languages: Python, Bash (daily) Go (familiar)

---

Security is not a feature. It is infrastructure.

All contributions are built for clarity, reproducibility, and operational reliability.