Defense cloud & security engineer
Twenty-five years in IT and cybersecurity, two decades in defense cloud and compliance. I author the controls and the authorization, engineer the systems and automation that satisfy them, and prove compliance with evidence and AI-assisted analysis — the whole arc, by one practitioner.
Available for select consulting & fractional security / compliance engagements
What I do
AWS Commercial and GovCloud architecture across IL2–IL6 environments — hardened-AMI pipelines, Infrastructure as Code, DevSecOps/CI-CD, IAM/PKI, enterprise networking, DR and high availability. Nearly a decade of AWS. This is the core.
Centralized, NIST-aligned audit logging and monitoring on OpenSearch with AWS Config, Security Hub, GuardDuty, and Inspector; system-architecture-to-OSCAL control mapping; open-source OSCAL tooling that turns compliance into code.
The RMF process end-to-end (NIST SP 800-37): control-implementation and SSP authoring, eMASS package development to ATO, NIST 800-53 implementation, assessment and POA&M workflow, OSCAL, FedRAMP.
Large-language-model application to compliance and document analysis — extracting control narratives into source-grounded, confidence-scored structured assertions.
Selected work
An independent practice delivering AWS architecture, cybersecurity, and compliance-driven engineering to government and mission-focused customers — spanning P&L, business development, and end-to-end delivery.
Laid the foundational engineering for both the classified and unclassified Cloud Computing Environments at Air Force Special Operations Command — among the command's earliest AWS deployments, spanning unclassified through IL6, in direct support of the CTO.
Developed a complete RMF authorization package end-to-end in eMASS for the Exhibit Arts Fulfillment System (DPFSO contract) — authored the control implementations and SSP, and earned the system's initial ATO under a designated Authorizing Official at the Defense Human Resources Activity.
A source-available event-management platform built end-to-end and offered as a Palladium product — engineered as a security-and-compliance reference: server-enforced safe mode, scoped audit logging, and the same hardened-AWS deployment pattern I bring to client work.
A dependency-free generator that turns the FedRAMP CR26 preview into machine-readable OSCAL artifacts (XML/JSON/YAML), profile shells, and NIST SP 800-53 Rev 5 mappings — compliance as code.
Writing
Short field notes on OSCAL, the RMF in practice, and using language models for real compliance work. First pieces are in progress.
Experience
Background
I started as an F-111 aircraft maintainer in the Air Force, spent two decades engineering secure cloud for defense, and now build the automation and evidence that make compliance provable rather than performative. I also teach — undergraduate computer science and IT, as an adjunct professor — and somewhere in there earned a culinary-arts degree, because the work of getting the details exactly right is the same in a kitchen as it is in a control catalog.
Off the clock I'm a husband and a father of two, and a perpetual tinkerer — gardening, woodworking, and coaxing vintage electronics back to life. Same instinct, different bench: figure out how a thing works, then make it work better.
Contact
Compliance engineering, RMF and ATO work, secure cloud, or an OSCAL/AI problem worth solving — reach out, or grab a time directly.
Erik Cass