I find how systems break, fix the pipeline that let it happen, and watch for it in production.
Seven years in product security. I have led application and cloud security and built a security function end to end: threat models, pentests and code review, secure SDLC gates, AWS and Kubernetes guardrails, detection and response on a SIEM, ISO 27001 and SOC 2, and now securing the AI inside products.
security --owned
- appsec
- threat models · pentests · code review
- cloud
- AWS guardrails · EKS · vuln management
- pipeline
- SSDLC · ASPM · CI/CD gates · SBOM
- detection
- Wazuh · ATT&CK · incident response
- ai security
- LLM pentests · agent & MCP threats
- grc & it
- ISO 27001 · SOC 2 · EDR · MDM
Security tools
All projectsTools for the problems I kept hitting in pentests, cloud reviews and alert triage, plus one macOS utility on the side.
- wsprobeA WebSocket pentesting harness, a Python CLI and a Burp extension, for the traffic HTTP tools stop reading after the upgrade.Public
- LanternMy hackathon SIEM assistant (second of 33 teams), rebuilt and extended: read-only AI investigation over Wazuh and alerts grouped into incidents, with Wazuh 5 and an analyst case console next.Shipped, v2 in build
- WinnowAI-assisted secure SDLC: threat-models a codebase, reviews code alongside the scanners, maps the APIs that touch sensitive data, and confirms findings with a check outside the model.In build
- HorizonA cloud security platform for AWS and Kubernetes that joins posture, identity and runtime, and checks what is reachable from outside against what the inventory says exists.In build
- wardData-loss prevention for small teams across hosts, network and SaaS: it finds PII and secrets where they sit and reports each exit without copying the content.In build
- mobkitOne command line over adb, Frida, objection and drozer, with a scripted Android and iOS lab setup.In build
- hopA macOS browser picker that routes every link by your rules, or asks in one keystroke.Public
Recent writing
All writingWebSocket security
A long-lived, two-way connection changes the whole security question. Why HTTP instincts and tooling break on WebSockets, the bug classes that matter, and how I test them.
Building an AWS data perimeter
Least-privilege IAM says what a principal can do, not who can reach your data or from where. What a data perimeter is and the four controls that build one.
Contact
Reach me on email, LinkedIn or X. How I approach security is on my approach page.