About
I translate compliance into engineering, and back again.
I’m Nicholas Kanelos, and I founded Voltstep Advisory. My job is connecting regulatory requirements with the people and systems that have to meet them.
For more than a decade I’ve worked where regulation meets engineering, in healthcare, fintech, payments, retail, and software. I take a framework such as PCI DSS, HIPAA, ISO/IEC 27001, or NIST and CMMC, turn it into specific technical controls for cloud-native applications and infrastructure, and stay with product, engineering, and security teams until those controls are in place and evidenced.
I started Voltstep to offer that same work directly to organizations that need senior GRC engineering without a full-time hire. I do the work myself, and bring in vetted specialists when an engagement calls for them.
Voltstep is a Native American small business, owned by a citizen of the Chickasaw Nation.
Experience
- Compliance built into engineering. At Mastercard, I translated ISO/IEC 27001 policies into automated infrastructure as code and hardened AWS environments and Palo Alto firewalls to payments-industry security baselines.
- Multi-cloud remediation guidance. At H-E-B, as Senior GRC Analyst, I directed the translation of PCI DSS, HIPAA, and NIST requirements into internal controls and guided cloud engineering teams on remediation across AWS, GCP, and Azure. Earlier, as Senior Information Security Analyst there, I was the primary regulatory consultant to engineering and product teams for CI/CD pipelines, Kubernetes, and enterprise cloud platforms.
- ISMS governance through an acquisition. At Ally Financial, I governed the ISO/IEC 27001 ISMS and drove AWS security-posture improvements during a major platform acquisition, and enforced least-privilege identity governance across Azure, Azure DevOps, and Microsoft 365.
- Compliance designed into products. At SecureLink, I was the regulatory authority for product engineering, writing technical conformance guidance across major frameworks, including PCI, HIPAA, CJIS, FERC, ISO, NIST, and CIS, so privileged access management products met those standards before release.
- Third-party governance. As a senior information security contractor, I ran risk assessments of SaaS platform implementations and worked with security architecture to embed Zero Trust principles and encryption into the engineering lifecycle.
- AI security, today. As an AI Security Engineer (2026–present), I translate emerging AI governance and data protection regulations into engineering standards, and I have architected automated vulnerability management pipelines.
- Healthcare and regulated-product roots. Early healthcare IT and MSP work involved both HIPAA and PCI. I supported HIPAA and HITECH compliance across 9 clinical sites, delivered managed IT and security services to healthcare providers, and worked in medical-device regulatory affairs, including quality management, ISO 14971, and IEC 62304.
- Hands-on infrastructure. I built and managed more than 50 full racks of network, server, and storage equipment in 9 months. When I recommend a control, it comes from someone who has run the systems it applies to.
Credentials and education
- CISSP, (ISC)². Verify on Credly
- CCSP, (ISC)². Verify on Credly
- Cyber AB Registered Practitioner. Marketplace listing in progress.
- CCP and CCA, in progress. Training completed 2026.
- Licensed U.S. Customs Broker.
- Certified U.S. Export Compliance Officer (CUSECO), Dunlap-Stone University.
- M.S., Information Assurance and Cybersecurity, The Pennsylvania State University.
- Accelerated Management program, Yale School of Management.
- B.F.A., Fort Lewis College.
How I work
- I translate in both directions. I turn a requirement into a task an engineer can build, and technical reality into risk language executives can act on.
- I build controls that last. Where I can, I express requirements as code, pipelines, and automated checks, so the control holds after the engagement ends.
- I keep delivery in view. The goal is a control that satisfies the requirement and fits how your teams already ship.
- I develop people. I have trained and mentored a cohort of four GRC interns into full-time compliance and security roles, and as a manager I improved compliance-ticket resolution times by 30% in six months.
- I think like a regulated professional. Customs brokerage and export compliance are work where precision and documentation aren’t optional.
- I’m direct. You get clear findings early, in private, with a rationale you can defend later.
Measured momentum: progress you can prove.
The name is the idea: security programs move forward in deliberate, documented steps, and the volt is the energy that keeps them moving.
Let’s talk about what you need to prove, and to whom.
Book a call, or send the form. Tell me the framework, the deadline, and what’s worrying you. If I’m not the right fit, I’ll say so and point you to someone who is. 30-minute intro call on Google Meet.
VOLTSTEP LLC · Based in the Baltimore–DMV Metro corridor, where we also work onsite. Remote nationwide.
Next step
Start with a 30-minute call.
Tell us what you’re working on and when it’s due, and we’ll tell you the first two steps.
30-minute intro call on Google Meet