Block or report aarondutton-grc
Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.
You must be logged in to block users.
Contact GitHub support about this user’s behavior. Learn more about reporting abuse.
Report abuseI'm a GRC and Information Security professional with 10+ years of experience in healthcare technology, specializing in compliance program management, risk assessment, and audit leadership in HIPAA-regulated environments.
- Audit & Compliance: SOC 2 Type II (280+ controls, 100% effectiveness across three consecutive cycles), HIPAA, NIST CSF, NIS2
- Risk Management: Third-party vendor risk (300+ vendors annually), risk register ownership, FAIR/PASTA threat modeling
- Frameworks: NIST CSF 2.0, NIST 800-53, ISO 27001, PCI-DSS, SOC 2 TSCs
- Policy & Governance: Policy lifecycle management, customer security questionnaires (SIG, CAIQ, custom formats)
- Domain Expertise: Healthcare technology, organ transplant software (HIPAA, PHI governance)
This GitHub contains hands-on GRC and security tooling built in Python, demonstrating practical application of security concepts:
| Category | Tools |
|---|---|
| Threat Modeling | PASTA + FAIR Threat Modeling Case Study — ransomware risk quantification for a healthcare SaaS platform, Monte Carlo ALE simulation, control ROI analysis |
| Threat Intelligence | IOC Threat Feed Aggregator (OTX, URLhaus, Feodo Tracker), ThreatFox Recent IOCs, CISA KEV, VirusTotal File Scanner — file upload, hash cache lookup, AV engine verdict, VirusTotal Domain Report — domain verdict, registrar info, DNS records, flagging engines, VirusTotal URL Scanner — URL submission, multi-engine detection summary, malicious/suspicious engine breakdown, AbuseIPDB Blacklist Generator — firewall-ready IP blacklist, country filtering, confidence score thresholds |
| Asset & Infrastructure Recon | Shodan Host Lookup — passive external recon, CVE exposure, SSL/TLS expiry (NIST CSF ID.AM / ID.RA) |
| Vendor & Domain Risk | HIBP Email Breach Checker — single and bulk email breach lookup with full breach detail, HIBP Domain Breach Scanner — owned-domain email exposure via paid HIPAA account, HIBP Vendor Breach Checker — third-party vendor breach metadata via free API (no email-level data), HIBP Password Checker — k-anonymity password breach lookup, Tkinter GUI, SHA-1 prefix/suffix model, AbuseIPDB, WHOIS, URLScan, WhoisXML URL Categorizer — domain content categorization, IAB taxonomy, batch scanning, AUP enforcement, Cloudflare Radar URL Scanner — URL categorization, phishing/malware verdicts, technology fingerprinting, batch scanning, JSON export |
| Vulnerability Assessment & Security Testing | SSL Labs Scanner — TLS/SSL assessment, certificate lifecycle, cipher suite analysis, PCI-DSS compliance checking |
| Vulnerability Management | NIST NVD CVE-to-CWE Mapper — CVE lookup, CWE enrichment, CISA KEV cross-reference, CVSS scoring, CSV/JSON export, CISA KEV Analyzer — full KEV catalog analysis, vendor risk ranking, ransomware CVE correlation, patch deadline tracking, Excel export |
| Healthcare & Regulatory | NPPES NPI Lookup — provider lookup by NPI or name, Luhn validation, wildcard search, Medicaid identifiers, authorized official info, openFDA Safety Monitor — drug recalls, adverse event signals, food allergen recalls, timestamped Excel export, WHO ICD-11 Code Lookup — code and keyword search, inherited exclusion traversal, OAuth2 auth, HHS HIPAA Breach Scraper — full portal scrape of OCR breach data, JSF session handling, pagination, date filtering, Excel/CSV/JSON export, HIPAA Compliance Worksheet — full Security Rule control mapping (Admin/Physical/Technical), multi-framework crosswalk (ISO 27001, SOC 2, NIST CSF 2.0), OCR guidance, NPRM 2025 proposed changes, AI governance and remote work controls |
- 🔄 CompTIA Security+ (in progress)
- 🔄 ISC2 Certified in Cybersecurity (CC) (in progress)
- 🎯 CISSP (roadmap)
- 🎯 CRISC (roadmap)
- Led SOC 2 Type II audit program at CareDx (healthcare technology, organ transplant space) — 280+ controls, three consecutive cycles with 100% effectiveness
- Managed third-party vendor risk program covering 300+ vendors annually
- HIPAA compliance and PHI governance in a regulated healthcare SaaS environment
- Customer-facing security questionnaire support (SIG, CAIQ, custom formats)
- 🌍 Portfolio: aarondutton.tech
- 💼 LinkedIn: aarondutton.work
- 📧 aaron@aarondutton.me
Popular repositories Loading
-
virustotal-domain-report virustotal-domain-report Public
Scan a domain for a verdict on if it is malicious, suspicious or clean. Scans with multiple engines. Returns basic Registrar information, Reputation score, DNS records.
Python 1
-
-
ioc-threat-feed-aggregator ioc-threat-feed-aggregator Public
Python CLI tool that checks domains, IPs, and URLs against Abuse.ch and AlienVault OTX threat intelligence feeds
Python
-
shodan-host-lookup shodan-host-lookup Public
Passive external reconnaissance tool using the Shodan API — built for GRC/vendor risk workflows
Python
-
threat-fox-recent-iocs threat-fox-recent-iocs Public
Fetches 1–7 days of ThreatFox IOCs, displays color-coded results to terminal, and exports to CSV
Python
-
ssl-labs-scanner ssl-labs-scanner Public
checks SSL cert on selected host and can output to screen or text file
Python
If the problem persists, check the GitHub status page or contact support.