IAM · Cloud security · Identity for the AI era

I'm Christopher. I secure who gets access
across the cloud, for people and AI agents.

See my work → LinkedIn GitHub

About

I work on identity and access: who gets in, what they can touch, and how you prove it to an auditor.

My projects are hands-on labs and control tests. I build the access control in AWS or Microsoft Entra, try to break it, and write up the evidence against the framework it satisfies, usually NIST 800-53 or ISO 27001.

01Cloud IAMAWS IAM users, groups, roles, trust policies and STS
02Identity lifecycleJoiner, mover and leaver automation with PowerShell and Microsoft Graph
03ITGC & auditAccess reviews, separation of duties and control testing

Experience

16+years in compliance, access governance and ERP systems
0audit findings across a 16-year tenure
B.S.Cybersecurity, Grand Canyon University
Certified 2024CompTIA Security+ In progressSC-300 Identity & Access Administrator In progressServiceNow CSA PlannedOkta Certified Professional
DEC 2025 – PRESENT

Accounts Payable & Systems Compliance Specialist

CEVA Logistics

  • Administer vendor access and permissions in ERP and payment systems, keeping access role-appropriate and least-privilege.
  • Resolve access discrepancies and permission conflicts across JDE, OnBase and CargoWise.
  • Run vendor onboarding and offboarding, including credential provisioning and deactivation.
  • Support internal audit with access and transaction evidence for financial controls and segregation of duties.
DEC 2024 – JUN 2025

Accounting & Compliance Clerk

Associated Students, Inc., CSU Dominguez Hills

  • Managed user permissions on budgeting and financial reporting systems for student organization accounts.
  • Kept audit-ready access records and compliance documentation for CDC grant-funded programs.
JAN 2007 – MAY 2023

Accounting Clerk & IT Systems Liaison

The California Club

  • Primary IT contact for office systems, hardware, software updates and user access troubleshooting.
  • Managed role-based access across AP, AR and billing systems with segregation of duties.
  • Provisioned vendor portal access and kept vendor compliance records for annual audits.
  • Zero audit findings across 16 years of reconciliations and GL balancing.
2023B.S. CybersecurityGrand Canyon University
In progress · Dec 2026MBA, Technology ManagementWestern Governors University

AI × Identity

AI is the next wave of tech, and every AI agent is a new identity that needs access control.

Agents get least privilege too

An AI agent or service account should get scoped, short-lived credentials, the same way I scope IAM roles in AWS.

AI-assisted access reviews

AI can flag risky or unused access before a review. A person still signs off, and the evidence holds up in an audit.

Every action is audited

Whether a person or a model made the call, the log should show who, what and why. That's the ITGC mindset applied to AI.

What I'm building

Founder & builder

Rolevara

Experience the role. Master the work.

Rolevara is a job simulator for security, IT and business roles. Instead of watching videos, learners do the actual job at a fictional company, Pacific Crest Logistics. They work real-looking tickets, calls and alerts, and they're graded on outcome, process and evidence, so they walk into the interview having done the work.

Visit rolevara.com →
  • IAM shift: a live ticket queue of joiners, leavers, MFA resets and urgent lockouts. A ticket that isn't really fixed reopens, and missed work comes back later as an incident.
  • GRC audit: audit a shift as the internal auditor, from walkthrough and sampling to control testing, findings and risk ratings.
  • Real frameworks: tasks map to NIST 800-53, ISO 27001, SOC 2, HIPAA and PCI DSS.
  • More tracks: SOC alerts, PAM, help desk calls and platform labs in Microsoft Entra and AWS.
ReactTypeScriptViteSupabaseVercel

Projects

Hands-on IAM labs and ITGC control tests. Each one names the control it proves and shows the evidence.

github.com/ChrisAshleyTech →
ChrisAshleyTech/aws-iam-least-privilege-user

Least-privilege IAM user

Provisioned an AWS user through group-based RBAC and enforced MFA. Then proved the control works by trying an out-of-scope action and capturing the denial.

NIST AC-2AC-3AC-6AWS IAMMFA
View on GitHub →
ChrisAshleyTech/aws-iam-role-trust-vs-permission-policy

Role trust vs. permission policy

Hand-wrote both policies for an S3 read-only role with no managed policies. Traced a failed Switch Role to the caller missing its own sts:AssumeRole grant.

NIST AC-3AC-6IAMSTSS3
View on GitHub →
ChrisAshleyTech/aws-ec2-cross-service-s3-role

EC2 to S3 with an instance role

An EC2 instance reads from S3 through an attached IAM role. It runs on temporary credentials, with no access keys stored on the instance.

EC2IAMS3
View on GitHub →
ChrisAshleyTech/jml-automated-deprovisioning

Automated leaver deprovisioning

PowerShell automation for the Joiner-Leaver lifecycle that deprovisions accounts through Microsoft Graph. Built as an ITGC control-testing exercise.

NIST AC-2ISO 27001 A.9.2.6PowerShellMicrosoft Graph
View on GitHub →
ChrisAshleyTech/periodic-access-review-itgc

Periodic user access review

An ITGC control test for a periodic access review. It includes the test plan, the evidence, and remediation of a real exception.

NIST AC-2(3)AC-6ITGCAudit workpaper
View on GitHub →
ChrisAshleyTech/sod-conflict-detector

SoD conflict detector

A browser tool that reads a user-to-role CSV and flags separation-of-duties conflicts against a defined rule set.

JavaScriptCSVSoD rules
View on GitHub →