Jermaine Ragsdale — Cybersecurity Architect & Cloud Engineer

Expertise

Skills & Technologies

Cloud Security Architecture

Designing and implementing enterprise-grade security across multi-cloud environments with zero-trust principles and defense-in-depth strategies.

AWS Azure Zero Trust IAM

Compliance & Governance

Translating regulatory requirements into automated controls and continuous monitoring for financial services and federal environments.

SOX PCI-DSS FedRAMP NIST 800-207 HIPAA ISO 27001

Infrastructure as Code

Automating cloud infrastructure with declarative templates, policy-as-code, and CI/CD pipelines for immutable deployments.

Terraform Bicep CloudFormation GitHub Actions

Full-Stack Development

End-to-end development from serverless backends to responsive frontends, with emphasis on secure coding practices and clean architecture.

Python JavaScript React REST APIs

Threat Detection & SIEM

Implementing security monitoring, incident response workflows, and threat intelligence feeds to detect and neutralize advanced threats.

Splunk Sentinel GuardDuty MITRE ATT&CK

AI & Large Language Models

Applying LLMs to real security problems: automated log analysis, IaC review pipelines, and local on-premise deployment for regulated environments where data cannot leave the network.

Claude ChatGPT Gemini LM Studio Amazon Bedrock Azure OpenAI

Career

Professional Experience

11/2025 — 03/2026

Senior Cybersecurity Architect

Truist Bank via Pride One Global · Atlanta, GA

Collaborated with cross-functional teams to develop security blueprints and identify risks across enterprise systems. Assessed architecture vulnerabilities and defined security controls to strengthen Truist's cloud and infrastructure posture.

11/2024 — 11/2025

Independent Security & AI Engineering

Self-directed · Atlanta, GA

Between roles, I invested the time in hands-on building rather than waiting. Designed and shipped the security automation and AI tooling featured in my case studies — an on-prem LLM security copilot, a multi-LLM IaC security reviewer, and serverless scanning pipelines — while sharpening cloud and AI credentials (AWS AI Practitioner).

05/2023 — 11/2024

Security Research Engineer

Cisco · Atlanta, GA

Led annual DevOps security enhancements and championed secure development lifecycle adoption across 80+ teams, achieving 90% compliance with enterprise architecture guidelines. Mentored development teams in prioritizing security hardening, reducing vulnerabilities by 70%.

◆ ScaleDrove a 70% vulnerability reduction not on one team, but across 80+ engineering teams at once.

10/2020 — 05/2023

Senior Cloud Security Engineer

Truist Bank · Marietta, GA

Designed enterprise cloud architecture leveraging AWS Security Hub, Macie, and GuardDuty, reducing threat detection time by 50%. Ensured 100% compliance with NIST CSF, FedRAMP, and PCI-DSS, reducing cloud misconfigurations by 45%.

07/2019 — 10/2020

Senior Security Engineer II

Fiserv · Marietta, GA

Guided security engineering teams in encryption strategies securing 100TB+ of sensitive data. Led enterprise-wide compliance ensuring 100% alignment with NIST, FedRAMP, ISO 27001/27002, PCI-DSS, and HIPAA standards.

◆ ScaleEncryption strategy covering 100TB+ of sensitive financial data, held to five overlapping regulatory regimes at once.

02/2005 — 07/2019

Network Security Engineer

Verizon Communications · Richmond, VA

Spearheaded security infrastructure efforts contributing to 99.999% uptime, securing Verizon's #1 J.D. Power ranking for reliability in 2015. Prioritized high availability and disaster recovery across video network infrastructure.

◆ Put in perspectiveThat 99.999% uptime is five-nines — under 5.3 minutes of unplanned downtime across an entire year.

Work

Case Studies

AWS · Security · Serverless

Secure File Upload with Malware Scanning

Challenge

Every S3 upload path is a blind spot. Files arrive, land in buckets, and get served — with no visibility into what's actually inside them. One infected upload touches everything downstream.

Approach

Lambda triggers on every S3 PutObject event, runs the payload through a ClamAV container, then routes the result: clean files are promoted to the delivery bucket; infected files go to quarantine with full metadata logged to CloudWatch.

✓ Outcome

100% automated scanning with no manual review step. Sub-2-second scan latency. Full tamper-evident audit trail for compliance reporting. Infrastructure provisioned entirely in Terraform.

100%

Files Scanned

<2s

Scan Latency

Manual Reviews

AWS Lambda S3 ClamAV Terraform CloudWatch

GitHub →

Azure · Network Security · IaC

Secure Hub-and-Spoke Network Architecture

Challenge

Enterprise multi-team Azure environments sprawl into flat networks. Any compromised VM can pivot laterally across every workload. Security teams lack east-west traffic visibility until after a breach.

Approach

Hub-and-spoke topology with Azure Firewall at the center. All spoke-to-spoke traffic routes through the hub for deep-packet inspection. User-Defined Routes (UDRs) and NSGs enforce segmentation. Every component provisioned with Terraform so the architecture is repeatable across environments.

✓ Outcome

Full east-west traffic inspection, blast radius contained per spoke, zero implicit trust between workloads. One Terraform apply provisions the entire topology — production-identical environments in minutes.

100%

Traffic Inspected

Isolated Spokes

IaC

Fully Automated

Azure Firewall VNet Peering UDR NSG Terraform

GitHub →

DevSecOps · Policy-as-Code · Compliance

IaC Policy Enforcement Pipeline

Challenge

Infrastructure-as-Code is fast. Fast + wrong means misconfigured security groups, open S3 buckets, and missing encryption — deployed at scale before anyone notices. Manual security reviews don't scale to 80+ teams.

Approach

Open Policy Agent (OPA) sits as a gate in the CI/CD pipeline. Terraform plans are evaluated against a policy library before any apply runs. Violations block the deployment with an explicit policy failure message — no deploy, no exception, no override.

✓ Outcome

Security misconfigurations caught at commit time, not post-deploy. Policy drift eliminated. Compliance enforced automatically at the infrastructure layer — the security team reviews policy rules, not individual PRs.

Policy Bypasses

CI/CD

Gate Enforced

Auto

Compliance

OPA / Rego Terraform CI/CD Policy-as-Code NIST CSF

GitHub →

Python · LM Studio · Air-Gap Ready

Local LLM Security Copilot

Challenge

Security teams in regulated environments — banking, defense, healthcare — can't send logs, configs, or vulnerability data to cloud AI services. But manual analysis of security events doesn't scale, and analysts burn hours on repetitive triage.

Approach

A Python-based security copilot powered by locally-hosted LLMs (Mistral, Llama 3) via LM Studio. Log analysis, CVE explanation, and configuration review all happen on-premise with zero network egress. No API keys, no telemetry, no cloud dependency.

✓ Outcome

Full AI-assisted security analysis with zero data leaving the network. Three analysis modes — log triage, CVE lookup, and config audit — running at analyst speed. Drop-in deployment for air-gapped environments.

Data Egress

100%

On-Premise

Analysis Modes

LM Studio Python Mistral / Llama 3 Zero Telemetry

GitHub →

Python · Multi-LLM · CI/CD

AI IaC Security Reviewer

Challenge

Static IaC scanners catch known patterns but miss subtle misconfigurations — overly permissive wildcards, implicit public access, missing encryption defaults. Security teams can't manually review every Terraform PR across dozens of engineering teams.

Approach

A multi-LLM review pipeline that evaluates Terraform and Bicep files against security best practices. Supports Claude, GPT-4, and local models via LM Studio. Integrates as a CI/CD gate — code gets AI-reviewed before it merges, not after it deploys.

✓ Outcome

LLM-powered security review at PR velocity. Catches semantic misconfigurations that rule-based scanners miss — with explanations, not just flags. Air-gapped mode available via LM Studio for regulated environments.

LLM Backends

CI/CD

Integrated

Semantic

Analysis

Claude ChatGPT LM Studio Terraform CI/CD

GitHub →

AWS · Bedrock · Serverless

S3 AI Image Tagger

Challenge

Organizations with large S3 image libraries have no searchability. Files are named arbitrarily and lack metadata. Finding a specific image means scrolling through hundreds of objects — manual tagging at scale is impractical.

Approach

An event-driven Lambda pipeline triggered on every S3 upload. Images are sent to Amazon Bedrock's Claude Vision model for captioning and semantic tag generation. Results are written back as S3 object tags and stored as JSON sidecar files for indexing.

✓ Outcome

Fully automated image cataloging with zero manual input. Every uploaded image gets AI-generated captions and tags within seconds, making the entire S3 library searchable by content. Infrastructure provisioned entirely in Terraform.

Auto

Tagged

<5s

Latency

100%

Searchable

Amazon Bedrock Claude Vision Lambda Terraform

GitHub →

View All Repositories

Open for Business

Cloud Security & FedRAMP Advisory

I help organizations secure their cloud infrastructure and navigate federal compliance — with the same hands-on depth I've applied at Cisco, Truist, Fiserv, and Verizon. Not just recommendations. Working architecture, real controls, and documentation that satisfies auditors.

FedRAMP Readiness & Authorization

End-to-end guidance through the FedRAMP authorization process. I assess your current posture against NIST 800-53, identify gaps, design remediation plans, and prepare your SSP and supporting documentation for the 3PAO assessment.

NIST 800-53 gap analysis & remediation roadmap
System Security Plan (SSP) development
Control implementation & evidence collection
3PAO assessment preparation
Continuous monitoring program design

Start a conversation →

Cloud Security Architecture

Security architecture design and review across AWS, Azure, and GCP. From network segmentation and IAM policy design to encryption strategies and logging pipelines — security built into the cloud foundation, not bolted on after.

Zero-trust architecture design (AWS, Azure, GCP)
Cloud security assessments & gap analysis
IAM, encryption & key management strategy
IaC security reviews (Terraform, Bicep)
SIEM pipeline design & implementation

Start a conversation →

Compliance & Security Programs

Whether you're preparing for SOC 2, ISO 27001, PCI-DSS, or HIPAA, I build the technical controls and evidence collection processes that satisfy auditors — real security posture, not checkbox compliance.

Multi-framework compliance (NIST, ISO, PCI, HIPAA)
Security program development & roadmapping
DevSecOps pipeline security integration
Threat modeling & risk assessments
Fractional CISO & board-level reporting

Start a conversation →

How I Work

Discovery & Scoping

A 30-minute call to understand your environment, compliance targets, and timeline. I'll tell you upfront if I'm the right fit.

Assessment & Gap Analysis

A thorough review of your architecture, policies, and controls against your target framework. You get a prioritized roadmap — not a shelf report.

Remediation & Build

Hands-on work designing and implementing controls, configurations, and documentation. I work alongside your engineering team, not in a silo.

Validation & Handoff

Pre-audit testing and evidence prep so your team walks into the assessment confident. Plus internal runbooks for independent maintenance.

Engagement Models

Advisory Retainer

$2,500/mo

Starting at 5 hours/month

Ongoing access for architecture reviews, compliance questions, and strategic security decisions. Ideal for startups building their security posture.

Async availability via Slack or email
Monthly architecture review call
Policy and control review

Project-Based Engagement

Custom Scope

Typically 3–6 month engagements

Dedicated support for a specific initiative — FedRAMP authorization, cloud migration security, or compliance audit prep from start to finish.

Defined deliverables and timeline
Weekly progress syncs
Hands-on architecture work
Documentation and runbooks

Fractional CISO

$8,000/mo

Starting at 20 hours/month

Senior security leadership without the full-time cost. Board-level reporting, vendor risk management, incident response planning, and security program strategy.

Security program leadership
Board and investor reporting
Team mentoring and hiring support
Vendor and risk assessments

Engagements are remote-first with on-site availability in the Atlanta metro. Reach out with a brief description of your challenge and I'll respond within one business day.

Don't just designsecurity — build it.

Enterprise Security ArchitectWho Ships.

Skills & Technologies

Cloud Security Architecture

Compliance & Governance

Infrastructure as Code

Full-Stack Development

Threat Detection & SIEM

AI & Large Language Models

Professional Experience

Senior Cybersecurity Architect

Independent Security & AI Engineering

Security Research Engineer

Senior Cloud Security Engineer

Senior Security Engineer II

Network Security Engineer

Case Studies

Secure File Upload with Malware Scanning

Secure Hub-and-Spoke Network Architecture

IaC Policy Enforcement Pipeline

Local LLM Security Copilot

AI IaC Security Reviewer

S3 AI Image Tagger

Education & Certifications

Education

Bachelor of Science

Certifications

Certified Information Systems Security Professional

AWS Solutions Architect Associate

AWS Certified AI Practitioner

GIAC Cloud Security Essentials

ITIL V3 Foundation

Cloud Security & FedRAMP Advisory

FedRAMP Readiness & Authorization

Cloud Security Architecture

Compliance & Security Programs

Discovery & Scoping

Assessment & Gap Analysis

Remediation & Build

Validation & Handoff

Advisory Retainer

Project-Based Engagement

Fractional CISO

Get in Touch

Email

LinkedIn

GitHub

Location

Don't just design
security — build it.

Enterprise Security Architect
Who Ships.