Resume
Harley Gilpin
Software Engineer · IT Auditor (CISA)
Eugene, Oregon
Software engineer and CISA-certified IT auditor in Eugene, Oregon. 15 years building, securing, and maintaining web applications for small-business clients, and 4+ years at Armanino testing SOC 1 and SOC 2 controls and building the automation that scales audit delivery across an 80-client portfolio. Work spans full-stack web (React, Next.js, Astro, Django, Stripe), internal tooling and workflow automation, application security, and Unity/XR development.
2011
Building for the web since
CISA
Certified by ISACA, 2026
4+ yrs
SOC 1 / SOC 2 audit
20+
Production sites shipped
Experience
- Mar 2022 – Present
IT Audit Associate II
Armanino LLP · Remote
- Perform control testing and evaluate audit evidence on SOC 1, SOC 2, and AUP engagements for financial institutions, credit bureaus, and education SaaS clients.
- Evaluate IAM (authentication, role-based provisioning, privileged access, terminations) and ITGCs against SSAE 18 Trust Services Criteria.
- Engineered a Django platform that scaled delivery across 80 clients: 2,000+ manual hours removed in year one and 40% faster report cycle time.
- Developed automation that drafts SOC 2 reports and sets up testing workpapers, raising reporting throughput 300% in 6 months.
- Built automation for client acceptance and onboarding pipelines, integrated with QRM acceptance review so high-risk engagements are flagged automatically.
- Document control exceptions and remediation recommendations for engagement managers to review with clients; write team docs and train non-technical staff on tooling.
- May 2011 – Present
Freelance Software Engineer & Consultant
harleygilpin.com · Eugene, OR
- Delivered and maintain 20+ production marketing and e-commerce sites, owning each account from scoping and quoting through post-launch support.
- Implement designs from brand guidelines, then tune for SEO, Core Web Vitals, and accessibility.
- Integrate Stripe, Auth.js, Resend/EmailJS, Cloudflare, and Vercel, and document each site so clients can self-serve.
- Harden sites (TLS, CSP, input validation) and run a WAF that blocked 15,000+ intrusion attempts in one year, with zero client security incidents.
- Built and published three Unity social VR worlds (Quest/SteamVR) and deployed Unity iOS/Android apps to devices.
Selected Work
View projectsVoid: MMO Preservation & Emulation Project
Second-largest contributor to Void, an open-source Kotlin server that preserves and faithfully emulates a 2011-era MMO so it stays playable after the original version was retired (170+ stars, 100+ forks). 83 merged pull requests since May 2025, recreating whole game systems end to end across content scripts, data definitions, and tests.
- Summoning: every familiar special and passive ability, pets, and beast-of-burden storage.
- A random events framework plus the events built on it.
- PvP bots that fight players in the Clan Wars free-for-all arena.
- The Hunter skill: box traps, deadfalls, magic boxes, falconry, and kebbit tracking.
- Player moderation (report abuse, mute, ban, black marks) and bank PIN security.
- Tutorial Island, several minigames, and 440+ missing drop tables and combat definitions.
- Reliability fixes, including dropped connections that never saved the player.
Subscription E-commerce Platform
Membership site for a coaching client: tiered Stripe subscriptions and webhooks, Google sign-in, a member portal with entitlement-gated video, and an admin panel. Migrated the existing WordPress subscriber base onto Stripe without interrupting billing.
Contractor Marketing Site & Local SEO
Launched as a React SPA, then migrated to statically generated Astro for crawlability and load time. Service pages, gallery, reviews, and an estimate form, backed by schema.org JSON-LD, Open Graph tags, canonical URLs, and a sitemap.
Multi-Client Delivery Platform
Internal Django platform running intake, scoping, status tracking, and reporting across an 80-account portfolio. Removed 2,000+ manual hours in its first year and cut report turnaround 40%.
Site Hardening & Web Application Firewall
Standardized TLS, CSP headers, and input validation across 20+ client sites and deployed a WAF that blocked 15,000+ intrusion attempts (SQL injection, XSS, bot traffic) in one year. Zero client security incidents to date.
Social VR Worlds for Meta Quest
Three social VR worlds published on VRChat for Meta Quest and SteamVR, including Space Yacht (2022). Held a steady 72 Hz on Quest through batching, atlasing, LODs, baked lighting, occlusion culling, and ASTC textures.
Watch Space Yacht walkthroughiOS & Android Builds
Unity and cross-platform mobile apps deployed to devices for clients and testers, with backend services and automated build and deployment pipelines. Fixed load-time, memory, and stability issues and carried SDKs through breaking upgrades.
Unreal Engine 5 Editor Tooling
Self-directed UE5 work building Editor Utility Widgets and Blueprint-based tools for asset and project workflows, expanding into C++ modules and the Automation Test Framework.