Beth (Julia Elisabeth) Gerharts

I built Risk Whisperer, an AI-powered GRC control assessor, from scratch using React and the Claude API. It generates security control assessments, risk scoring, and control-maturity ratings from plain-language system descriptions, with a Tech Talk/Plain Talk toggle so the same output reads clearly for technical or non-technical audiences. I built in a POA&M tracking module, input validation with prompt-injection filtering, and a serverless backend proxy to keep API credentials secure after catching an exposure risk in my own first version.

That security instinct came directly from my GRC internship at ROKS, where I reviewed policies, assessed risk, and analyzed internal IT assets and cloud-hosted services against NIST and ISO 27001 controls. I also traced an exposed private key back through the company's GitHub repository and assessed further exposure risk across Cloudflare and DigitalOcean configurations.

In a simulated Azure healthcare environment for my WGU capstone, I used Microsoft Defender for Cloud to identify misconfigurations, configured Entra ID for MFA and conditional access, and deployed Sentinel analytic rules for anomalous sign-ins, mapping everything to NIST RMF, NIST 800-53, and the CSA Cloud Controls Matrix.

I'm a career changer, coming from 20 years running my own business, into cybersecurity GRC — and I like building things that actually work, not just writing about frameworks in theory.