Technology risk. Evidence. Resilience.
A practitioner's journal at the intersection of audit defensibility, control automation, and AI governance — for regulated environments that demand evidence, not promises.
// Personal writing and small builds, published in my own time. Views are my own.
Built for regulated environments
Practical notes and small artifacts you can reuse: validation patterns, evidence rules, and control engineering that survives scrutiny.
What I keep coming back to
Three recurring themes. All evidence-driven.
Control automation
Patterns for automating control execution and evidence capture across the stack, with clear ownership and audit trails.
Evidence engineering
How to move from "screenshots and spreadsheets" to repeatable evidence pipelines: sources → rules → exceptions → remediation.
GRC platform modernization
How to think about data model, workflows, and integrations so your GRC tool becomes a system of record — not a ticket graveyard.
Where this shows up
Start with the friction that creates repeat findings and "audit panic".
SOX / ITGC continuous evidence
Automated evidence collection and exception reporting aligned to control owners and review cadence.
Third-party risk intake → monitoring
From onboarding questionnaires to continuous signal tracking and remediation workflows.
AI governance & GenAI controls
Policy-to-control mapping, model risk controls, and operational guardrails for enterprise AI usage.
Latest writing & builds
Two streams: writing for humans, scripts for builders.
Writings
Newest-first feed across Field Notes, Control Automation, and Labs.
Python Encounters
Small, opinionated utilities with a clear use-case. Source stays on GitHub.
- GRC-Tech
- Email header analyzer
- MD5 integrity check
- Net monitor
- SSL cert check
- FinTech
- FinTech stream (index) • growing
- Full catalog on GitHub
Explore by section
Start with a stream that matches your work.
Field Notes
Opinionated notes built for audit defensibility and clarity.
Control Automation
Guardrails, control engineering, evidence rules, and repeatable patterns.
Labs
Experiments, frameworks, and build logs that may evolve quickly.
GRCTech
GRC-flavoured tooling, automation, and scripts that serve assurance.
SecOPs
Security operations patterns: detection, response, and operational hygiene.
DevOPs
Delivery guardrails, CI/CD control points, and practical developer ergonomics.
AuditOPs
Running an audit / validation function with evidence that scales.
UserTech
Practical tools and workflows for everyday power users.
FinTech
Finance-flavoured risk, controls, and systems thinking.