Senior Security Engineer · Security Tooling · Cloud Security · DevSecOps
Six years in federal cybersecurity. I build tools that turn scan results and cloud configuration into evidence: where a vulnerability came from, which control it affects, and who can fix it.
What's In My Image (wimi) — Traces every package and CVE in a container image to the base image or the build step that added it, matching base layers by SHA-256 digest. Zero dependencies, runs air-gapped, imports Trivy / Grype / Harbor results. Signed releases with SLSA provenance and SBOMs. Sample report · Docs
cloudcomply — Go TUI that scores AWS Organizations against NIST 800-53 control families, filtered to the DoD Cloud SRG impact level (IL2–IL6) actually in scope. Single static binary that drops into AWS CloudShell.
gopher-scan — Concurrent TCP port scanner in Go: goroutine worker pool, hostname / IPv4 / IPv6 / CIDR targets.
CycloneDX Viewer — Browser-only SBOM viewer: search, sort, and export CycloneDX components to CSV.
- Security tooling — Go and Python tools for supply chain analysis, scanning, and evidence generation
- Cloud security — AWS architecture and hardening, infrastructure as code with Terraform
- DevSecOps — SAST, DAST, SCA, and container scanning built into CI/CD
- Software supply chain — SBOMs, SLSA provenance, signed artifacts
- Compliance as code — NIST 800-53 / RMF and DoD Cloud SRG mapped to real infrastructure
| Cloud & IaC | AWS (IAM, Organizations, Security Hub, Config, Control Tower), Terraform, Azure, GCP |
| Languages | Go, Python, Bash, PowerShell |
| Security tooling | Trivy, Grype, Harbor, Prowler, Nessus, OpenSSF Scorecard |
| CI/CD | GitHub Actions, security gates for SAST / DAST / SCA |
| Frameworks | NIST 800-53, RMF, FISMA, CMMC, DoD Cloud Computing SRG |
- Portfolio: willj4945.github.io/portfoliov2
- LinkedIn: linkedin.com/in/will-johnson-4a0b2b224
- Writing: Ramblings, my lab notebook
- Open to: Security Engineer roles in security tooling, cloud security, and DevSecOps (remote or hybrid)