Pharns Genece¶
AI Governance Engineer — Runtime AI Governance | NIST OLIR: 3 Final + 3 in Public Review | USPTO Patent-Filed (5 Provisionals)
I build the governance systems that make AI agents trusted to operate — cataloged by NIST as three Final OLIR Informative References across AI RMF 1.0, CSF 2.0, and SP 800-53 Rev 5.2.0.
My perspective comes from working across the autonomy continuum: automation → autonomy → AI, from remotely operated underwater vehicles and small unmanned aircraft, through RF and spectrum sensing, to cybersecurity and digital AI agents. I governed machines that could cause great harm before I governed software, and the control problem turned out to be the same one.
Runtime AI governance and governed autonomous execution — built, operating, and now cataloged in the NIST OLIR catalog with three Final Informative References.
My runtime AI governance framework, SDOS, is cataloged in the NIST OLIR catalog against AI RMF 1.0, Cybersecurity Framework 2.0, and SP 800-53 Rev 5.2.0 — enforcement at the runtime layer, mapped to all three federal references. From patent-filed autonomous execution architecture to compliance automation, control implementation, and detection engineering, every project here demonstrates one principle: AI without governance isn't safe to ship.
Best fit for teams that need governed AI execution, not just policy decks.
USAF Veteran · Held Secret clearance (inactive), clearance-eligible · Security+/CySA+/PenTest+/SSCP · FAA Part 107 · B.S. Cybersecurity (March 2026)
Founder of AAM Cyber →
Open to full-time AI governance and AI security engineering roles. Consulting engagements are handled separately — see Consulting & IP below.
Results at a glance¶
NIST OLIR Trifecta cataloged runtime AI governance framework Three Final Informative References cataloged at NIST (Final June 2026, zero comments): AI RMF 1.0 · CSF 2.0 · SP 800-53 Rev 5.2.0. OLIR catalog inclusion is an informative reference, not a NIST endorsement.
Two published, DOI-archived governance references The Five Laws of AI Governance (10.5281/zenodo.21271749) and the SDOS Runtime Governance Framework control catalog, v1.10 (10.5281/zenodo.22787187) — permanently citable, CC BY 4.0, ORCID-linked.
7 years production security Built enterprise IT security stack from scratch at USOG — CIS v8, NIST CSF, SOC 2
15,000+ vulnerability findings remediated Scanner-identified findings triaged and resolved across the full production estate over a 7-year tenure — endpoints, servers, and network services
<48 hours PCI-DSS endpoint hardening with audit-ready evidence pack — financial services client
10 industry certifications + 5 CompTIA stackables Security+, CySA+, PenTest+, Network+, A+, Project+, SSCP (Assoc.), ISC2 CC, ITIL4, LPI — plus CSAP, CNSP, CNVP, CSIS, CIOS stackable credentials → View all
B.S. Cybersecurity (WGU, Mar 2026) CIS v8 IG1-IG2 mapped to NIST CSF and SOC 2
Career USAF veteran Mission-critical operations, held Secret clearance (inactive)
Why I'm different¶
- I implement controls, not just map them. Framework requirements become working configurations, monitoring logic, and documented evidence — not recommendations in a report.
- I connect governance to operations. My work spans control design, technical implementation, telemetry pipelines, and audit-ready outputs. The documentation reflects what actually runs.
- I bring edge-domain depth most candidates don't have. RF/UAS security (USPTO patent filings, TraceLock™), governed automation systems, and real operator experience across USAF, a prior unmanned systems startup, and active consulting engagements.
What I build¶
I don't just architect governance — I ship working code. Public repositories with tests, docs, and reproducible results:
dbt CTI Pipeline Live abuse.ch threat feeds → behavioral-analytics tables via dbt Core + DuckDB. 6 models, 14 passing tests, lineage DAG. Details → · Repo dbt DuckDB Python
TraceLock — Multi-Domain Detection Python RF/BLE/Wi-Fi/ADS-B detection platform. Pilot study (n=3 controlled runs): detected every target vs. a 43% manual baseline, with a 57% time reduction; method documented and reproducible. Runs continuously on a Raspberry Pi sensor. Details → Python SDR Quantified
Detection Rules 12 custom Sigma-style rules across 5 categories with CI validation — DNS tunneling, HTTP beaconing, lateral movement, exfiltration. Details → · Repo Sigma MITRE ATT&CK Detection-as-Code
MCP Servers (production) Governed AI-to-tool connectors in daily use: a Proxmox MCP across a 48-VM cluster + a 61-tool governance MCP with HMAC-SHA256 module signing and per-tool access control. Python MCP Access Control
Production experience¶
USOG — Enterprise Infrastructure (7 Years) Built the IT security stack for a drone logistics company. Implemented CIS Controls v8 (IG1-IG2) mapped to NIST CSF and SOC 2. Deployed secure email, Nextcloud, remote access, and monitoring. Triaged and remediated 15,000+ scanner findings across the estate over multiple years. CIS v8 NIST Production
Healthcare MSP HIPAA + SOC 2 readiness assessment. Identified 12 control gaps, delivered prioritized remediation roadmap with 90-day implementation timeline. HIPAA SOC 2 Healthcare
Financial Services SMB PCI-DSS Windows 11 endpoint hardening. 47 controls mapped to CIS benchmarks, audit-ready evidence pack delivered in <48 hours. PCI-DSS CIS Endpoint
Law Firm Security Comprehensive security assessment and remediation. M365 hardening, dark web monitoring, endpoint protection deployment. Assessment M365 Remediation
USOG: Internal infrastructure I built and maintained as founder and security & systems lead. Client engagements via AAM Cyber.
Aerospace & Defense Recruiters — Unique AAM/UAS Credentials
I don't just study drone security — I've designed, built, and fielded operational UAV systems.
- Founder & operator of a drone logistics company (USOG, 2018–2025) — 7 years hands-on operational experience
- USPTO patent filings (named inventor) in UAV payload and delivery architectures
- TraceLock™ — Patent-filed RF threat detection platform (Wi-Fi/BLE/SDR/GPS/ADS-B)
- FAA Part 107 certified | HAM/GMRS licensed | career USAF veteran
Few practitioners combine drone operations, RF/SDR expertise, and cybersecurity credentials. View full AAM credentials →
Why hire me for GRC engineering¶
Most GRC professionals write policies and manage spreadsheets. I architect and deploy the technical systems that satisfy those controls — then document them with audit-ready evidence.
Endpoint Compliance¶
Delivered PCI-DSS Windows 11 hardening (BitLocker, GPO, EDR) with a complete evidence pack in <48 hours.
Compliance Automation¶
Deployed GIAP™, an intake platform (n8n, Nextcloud) with RBAC, retention policies, and 100+ framework coverage.
Evidence Pipelines¶
Built audit-grade logging systems with structured schemas and export workflows for cloud and access control data.
Detection & Response¶
Operate a Security Onion + TheHive/Cortex lab to author SIEM rules, tune alerts, and write IR playbooks.
Cloud Governance¶
Built an AWS Control Pack with S3 default-deny, GuardDuty pipelines, and scoped IAM mapped to CIS/NIST.
AI-Assisted Workflows¶
Use LLM tools for accelerated policy drafting, control mapping, and documentation with rigorous human review.
Bottom line: I design the framework, build the architecture, and deliver audit-ready evidence.
Featured GRC projects¶
GIAP™ — Governed Intake and Analysis Platform ⭐ Production GRC platform with live demo. CISO Assistant + n8n + Nextcloud + SuiteCRM. 100+ frameworks, HMAC-authenticated webhooks, end-to-end intake automation. GRC Automation Live Demo View Case Study · Try Live Demo
PCI-DSS Windows 11 Hardening Complete endpoint hardening with GPO, firewall rules, service lockdown, and evidence pack. Delivered for financial services client in <48 hours. Compliance Hardening Client Work View Case Study
AWS Cloud Control Pack S3 default-deny storage, GuardDuty findings export, scoped IAM with CIS/NIST mapping. Cloud Controls Architecture View Case Study
TraceLock™ — RF Threat Detection Patent-filed 6-domain wireless monitoring (Wi-Fi/BLE/SDR/GPS/ADS-B). Evidence-grade logging architecture and detection engineering. Detection RF/SDR Python View Project
Secure Intake Portal Nextcloud + n8n + SuiteCRM with RBAC, audit trails, and consent management. Multi-tier access controls. Infrastructure RBAC Deployed View Case Study
Agentic Infrastructure Audit — Foundational Architecture Governed two-machine AI agent environment with fixed-schema audits, drift detection, and security hardening for reproducible outputs across production sessions. Agentic AI Governance Detection View Case Study
PropTech RF Governance & Scope Control Governance-focused RF assessment of BLE and Wi-Fi activity in smart-building deployments. (PropTech = Property Technology: smart locks, IoT sensors, building automation.) Emphasizes scope discipline to prevent false positives and protect regulated work-from-home posture. GRC Privacy RF View Case Study
Detection engineering & offensive security¶
Current capability: Active detection/IR lab with Security Onion, TheHive/Cortex, custom SIEM rules, and authored detections. TraceLock™ RF/SDR telemetry demonstrates detection engineering fundamentals across 5 wireless sensing domains.
Growth trajectory: CySA+ and PenTest+ earned 2026, with the CSAP, CNVP, and CNSP stackables — detection and offensive-assessment coverage on both sides of the house. Building the penetration testing portfolio through lab work and vulnerability assessments.
Why this matters: GRC engineers who understand offensive techniques write better controls. Detection experience informs what to log and monitor.
AI-augmented security engineering¶
Security operations are documentation-heavy: control matrices, policy drafts, evidence collection, runbooks. I use governed automation to reduce that burden — faster delivery, same rigor.
| Outcome | How |
|---|---|
| Faster cross-framework control mapping | LLM-assisted mapping with structured prompts and human validation |
| Consistent, auditable evidence | Reproducible documentation output from structured schemas |
| Reduced manual SIEM authoring effort | LLM-assisted detection content with analyst review gate |
| Repeatable compliance delivery at scale | GIAP™ workflow automation — intake → framework → evidence |
Production systems: GIAP™ (live GRC automation platform — try the demo), TraceLock™ (RF threat detection with AI-assisted tuning and false-positive reduction), governed two-machine AI agent environment with fixed-schema audit outputs and drift detection.
Skills: Prompt Engineering · Multi-Agent Orchestration · Structured Output Design · n8n Workflow Automation · MCP Protocol · AI-Assisted Detection Tuning
Credentials & frameworks¶
Education B.S. Cybersecurity & Information Assurance (WGU) — Mar 2026
10 Industry Certifications + 5 Stackables Security+, CySA+, PenTest+, Network+, A+, Project+, ISC2 CC, SSCP (Assoc.), ITIL4, LPI — plus CSAP, CNSP, CNVP, CSIS, CIOS
Newly Earned 2026 CySA+ and PenTest+ — plus CSAP, CNVP, CNSP stackables
In Progress AWS Cloud Practitioner, ISC² CCSP
Framework experience: NIST CSF (PR.AC, PR.DS, DE.CM, RS.AN) · CIS Controls v8 · PCI-DSS v4.0 · SOC 2 · ISO 27001 (foundational)
Licenses: FAA Part 107 · HAM/GMRS · Veteran: USAF
Consulting & IP¶
I run AAM Cyber, a cybersecurity consultancy, and hold patent-filed IP through a separate holding entity. That history is why the governance work exists — and it raises fair questions for an employer. Answering them plainly:
- Full-time employment is the primary commitment. I am seeking a full-time individual-contributor role, not a contract bridge between engagements.
- Pre-existing IP is already separated. The patent portfolio is held by a dedicated IP holding entity, formed before any employment conversation, and is disclosed at hire.
- No adoption requirement. I build with the architecture and tooling the team already uses. Nothing here requires an employer to adopt or license SDOS.
- Outside engagements follow employer policy. Existing engagements are disclosed and approved in advance, per policy.
Consulting inquiries → AAM Cyber
What clients say¶
"Pharns delivered a complete compliance package with documentation quality that rivals consultants with twice his experience. His ability to implement technical controls while maintaining audit-ready evidence is rare."
— Compliance lead, healthcare MSP engagement, 2024 (via AAM Cyber)
Client named on request under NDA; references available to hiring teams.
AAM cybersecurity specialization¶
I don't just secure drones — I've designed, built, and fielded UAV systems.
Advanced Air Mobility (AAM) security requires practitioners who understand the engineering, not just the vulnerabilities. I bring hands-on experience across the full lifecycle:
| Capability | Evidence |
|---|---|
| UAV Engineering | Designed, built, and fielded operational UAV systems |
| USPTO Patent Filings | Patent filings (named inventor) in UAV payload and delivery architectures |
| RF Threat Detection | TraceLock™ 6-domain correlation (Wi-Fi/BLE/SDR/GPS/ADS-B) — rogue APs, trackers, drone proximity |
| Aviation Credentials | FAA Part 107 certified drone pilot |
| SDR/Wireless | HackRF, RTL-SDR — spectrum analysis and signal intelligence |
| Consulting | AAM Cyber — cyber-physical security services |
| Military Aviation | USAF aeromedical operations background |
Frequently asked questions¶
What is runtime AI governance?¶
Runtime AI governance enforces policy on autonomous AI agent actions at the moment of execution, not at policy-document time. It classifies every agent action by risk tier, gates dispatch through governance enforcement points, and produces a tamper-evident audit trail. It is the difference between an AI compliance program that exists on paper and one that actually enforces.
How is SDOS different from AI guardrails or AI safety frameworks?¶
Guardrails and most AI safety frameworks are advisory — they recommend behavior. SDOS is enforcement-bearing — agents physically cannot execute actions the policy layer denies. That enforcement layer is cataloged by NIST against AI RMF 1.0, CSF 2.0, and SP 800-53 Rev 5.2.0 as Final Informative References.
What does NIST OLIR catalog inclusion mean?¶
The NIST Online Informative References Program is the federal registry of frameworks that map to NIST core standards. Three SDOS Concept Crosswalks are cataloged: SDOS-RuntimeGov-to-AI-RMF-v1.0, SDOS-RuntimeGov-to-CSF-2.0-v1.0, and SDOS-RuntimeGov-to-SP-800-53-Rev-5.2.0-v1.0 — meaning any organization implementing AI RMF, CSF 2.0, or SP 800-53 has a publicly cataloged pathway to a runtime governance layer that enforces, not just advises. OLIR catalog inclusion is an informative reference, not a NIST endorsement of the framework.
Why does AI agent governance matter for regulated organizations?¶
Federal procurement, EU AI Act compliance, and NIST-aligned vendor risk programs all require demonstrable AI risk management. Most AI governance today is policy documents and post-incident reviews. Regulated organizations need controls that operate at the moment AI agents take action — not after. That is the gap SDOS closes — and SDOS is now cataloged against AI RMF 1.0 as a Final Informative Reference.
What is the risk of deploying AI agents without runtime governance?¶
Autonomous AI agents take actions that affect data, money, infrastructure, and human safety. Without runtime enforcement, agent actions are ungoverned at the moment they occur. Audit becomes forensic — after the fact, after the loss. Runtime governance moves enforcement to the point of decision, so violations are prevented rather than investigated.