Engagements, not demos.

The challenge

The agency had an existing ATO for on-premises infrastructure but needed to extend it to AWS under FedRAMP Moderate. Their current AWS footprint was a single account with no guardrails, ad-hoc IAM, and no centralized audit logging.

What we built

We designed a 6-account structure (management, log archive, audit, shared services, workload prod, workload dev) deployed via Terraform with a remote state backend in S3 + DynamoDB. Control Tower enrollment, SCP enforcement, and Config Rules provided the continuous compliance posture required for ConMon. A SIEM integration forwarded CloudTrail and VPC Flow Logs to the agency's existing logging platform.

Outcomes

• ATO boundary extension completed within 90 days
• Zero critical findings in third-party assessment
• Centralized logging covering 100% of API activity from day one
• ConMon automation reduced manual evidence collection by ~80%

Core toolchain

The challenge

The contractor was preparing for a CMMC Level 2 assessment and their existing pipeline had no automated security controls — developers could merge and deploy with minimal review. Manual processes were creating audit gaps and slowing delivery.

What we built

We migrated to GitHub Actions with branch protection, required code owners, and a multi-stage pipeline: lint → SAST (Semgrep) → dependency scan (Snyk) → container build → image scan (Trivy) → IaC validation (Checkov) → deploy to staging → DAST (OWASP ZAP) → manual approval gate → prod. OPA policies enforced image provenance and prevented unsigned artifacts from reaching production. All pipeline logs were captured and retained for audit evidence.

Outcomes

• CMMC Level 2 assessment passed with no pipeline-related findings
• Mean time to detect security issues reduced from days to minutes
• Pipeline evidence package auto-generated for quarterly audits
• Deployment frequency increased from weekly to daily after security gates reduced manual review burden

Core toolchain

The challenge

The client had thousands of internal technical documents, policy files, and project records that were impossible to navigate efficiently. Off-the-shelf AI tools were ruled out due to data residency and confidentiality requirements — all processing had to remain within their AWS environment.

What we built

We built a serverless ingestion pipeline using Lambda and Step Functions: documents were parsed, chunked, embedded using a Bedrock Titan Embeddings model, and stored in OpenSearch Serverless. A Bedrock-hosted Claude model handled query rewriting and answer synthesis, with the entire request/response cycle logged to CloudWatch for audit. The front end was a private internal tool deployed behind IAM authentication — no public endpoints.

Outcomes

• Query response time under 4 seconds for 95th percentile requests
• No third-party model providers — all inference within AWS
• Full audit trail for every query logged to CloudWatch
• Adoption reached 60% of target users within 30 days of launch

Core toolchain