Compliance for the SEC and the DoD

Two government programs, one stance: the infrastructure and the control story get built together. AWS infrastructure as code for a U.S. SEC data program through ATO prep, and before that, a DoD IL4 data warehouse that survived C5ISR testing.

client
TrussWorks
role
InfraSec Manager, then Tech Lead
when
2022 to 2024
drawn by
Jesse Tamburino
U.S. SEC · DATA PROGRAMGitLab CIpipelines01CloudFormationinfra as codeAWSFargateservicesRDSdataCyberArksecrets management02Shift leftsecurity earlyin the SDLCDoD · IL4 ENVIRONMENTTerraformsecurity baselines03Data warehousecustom, at IL4C5ISR testingpen tests + audits04ATO findingsaddressedMonitoringGrafana · Graylog · OpenSearchDNSRoute 53 → IoDynNIST 800-53r5 → CONTROLS AS CODE → EVIDENCE → ATO05diagrams, runbooks and support docs shipped with the infrastructure, not after it
Two programs, one pattern: controls as code, findings closed, evidence on hand.Hover a step below to find it on the sheet. Scroll sideways on small screens.
IL4DoD environment
r5NIST 800-53
ATOprepared

the problem

Government programs need modern infrastructure and an auditor-readable control story at the same time. Bolting compliance on at the end is how ATOs slip.

Constraints

  • NIST 800-53r5 controls have to be demonstrable, not just claimed.
  • IL4 is a DoD environment with its own rules about where data lives.
  • Pen testers and auditors from C5ISR (U.S. Army DEVCOM) will find things. Findings have to be closed, not argued.
  • The client is in the room every day. Communication is part of the deliverable.

Stack

AWSFargateRDSTerraformCloudFormationGitLab CICyberArkGrafanaGraylogOpenSearchNIST 800-53

how it is built

  1. 01

    SEC: pipelines and IaC

    Tech lead on an SEC program to modernize data reporting. Architected scalable AWS infrastructure as code on Fargate and RDS; built CI/CD in GitLab and CloudFormation.

  2. 02

    SEC: secrets and controls

    Implemented CyberArk and managed secrets, applied shift-left practices, maintained NIST 800-53r5 compliance and prepared for ATO.

  3. 03

    DoD: baselines as code

    Implemented infrastructure and security controls in Terraform, setting security-posture baselines, and architected a custom data warehouse at IL4.

  4. 04

    DoD: tested and fixed

    Worked security audits and pen tests by C5ISR, then addressed the ATO findings. Moved DNS from Route 53 to IoDyn and paired on a Grafana, Graylog and OpenSearch monitoring stack.

  5. 05

    Documented and led

    Diagrams, runbooks and support docs. Client discovery and kickoffs. Merge request reviews. Managed and mentored InfraSec engineers.

calls I made

Why it looks like this.

01

Controls as code

When the baseline is Terraform, the evidence for a control is a reviewed diff and a plan, not a screenshot.

02

Security in the pipeline

Scanning, review and secrets handling live in CI, where they run on every change, instead of in a pre-ATO scramble.

03

Docs ship with the infra

Diagrams and runbooks are part of the deliverable. An ATO package is easier when the architecture was written down as it was built.

Want the longer version, with the parts that went wrong?

Ask me about it