I build security products and I break them, which is why they work. These days that means AI-native application security tooling, agentic systems for offense and defense, and the model infrastructure and evaluation work underneath them. My background is offensive, years of penetration testing and secure code review before I started building the tooling that automates it, now extended to AI systems themselves through OSAI, OffSec's AI red teaming certification. Most of my engineering time goes into making AI-assisted security decisions auditable rather than opaque.

Security R&D Technical Lead @ Cyshield

• Architected an AI-native ASPM platform that scans on the customer's own machine and sends only finding metadata to the cloud, so source never leaves their environment
• Designed the rule pipeline and the finding-identity model that keeps triage decisions attached to a finding across re-scans
• Built the verification layer that asks a model whether a finding is real, and the MCP server that surfaces findings inside developers' coding agents
• Own the security architecture across the portfolio, including a commercially launched AI-powered WAF that sits inline on all customer traffic
• Led development of the agentic SOC systems our analysts use daily, where agents carry the investigation legwork and analysts stay accountable for disposition

• Deploy and tune open-weight models on vLLM and llama.cpp behind OpenAI-compatible gateways
• Build the agent harnesses and provider shims that let one security core run against a local or a hosted model without changes
• Run evaluation and security benchmarking against labeled corpora with deterministic graders, including the study that showed a security-tuned prompt on a locally served model recovering more real vulnerabilities than a frontier agent
• Measure cost alongside recall rather than after the fact, in that order: get it working, prove it finds what it claims, then bring down what it costs to run

• Discovered and responsibly disclosed critical vulnerabilities in Fortune 500 companies
• Notable companies: Twitter, Sony, Adobe, TripAdvisor, Ford Motors, Pinterest, Dell
• Published CVEs: CVE-2017-1000058 (Stored XSS at Chevereto CMS), CVE-2018-5222

• OffSec Advanced AI Red Teaming (OSAI) — verify
• Offensive Security Web Expert (OSWE)
• Certified Cloud Native Security Expert (CCNSE)
• Certified Container Security Expert (CCSE)
• Certified DevSecOps Professional (CDP)

• Web Application Penetration Tester Extreme v2 (eWPTXv2)
• Certified Professional Penetration Tester v2 (eCPPTv2)
• Mobile Application Penetration Tester (eMAPT)

• Primary Languages: Python, Java, JavaScript, TypeScript
• Additional: Ruby on Rails, MySQL, PostgreSQL, Bash

• Security Testing: SAST, DAST, SCA, Penetration Testing, Secure Code Review
• Security Tools: BurpSuite Pro, OWASP ZAP, Nuclei, Subfinder, httpx, Nmap, Metasploit, Wireshark, SonarQube, Semgrep, OpenGrep, Trivy, Gitleaks, Checkov

• Model serving: vLLM, llama.cpp, OpenAI-compatible gateways
• Integration: Anthropic, OpenAI, AWS Bedrock, self-hosted endpoints, MCP
• Agent evaluation, grader design, security benchmarking

• Cloud Security: AWS, Kubernetes, Docker
• DevSecOps: CI/CD Pipeline Security, IaC, Security Automation

A comprehensive training project demonstrating common security vulnerabilities in banking applications.

• Built with Python, Flask, SQLAlchemy, React, JWT Authentication
• Includes modules on secure code review, authentication vulnerabilities, and API security
• Implements real-world security scenarios and industry security standards