Security Engineer, San Jose CA
Security engineer specializing in AI security, cloud infrastructure and IAM, offensive security, and DevSecOps. Led an organization-wide cloud posture audit, establishing least-privilege IAM, network segmentation, and a zero-egress perimeter. Hardened self-hosted vLLM serving against prompt injection and trojaned releases, and built an autonomous offensive-security engine that sandboxes an abliterated open-weights model. OSCP certified with deep expertise in STRIDE threat modeling, shipping robust solutions in Rust, Golang, Python, Kubernetes, and Terraform.
Internal and external penetration testing across web, cloud, Active Directory, and Kubernetes. Attack-path analysis, exploit development, and an autonomous offensive-security engine that sandboxes an abliterated open-weights model.
Securing the LLM stack end to end. Hardened self-hosted vLLM serving against prompt injection and trojaned model releases, isolated agent tool servers, and threat-model AI systems with MITRE ATLAS.
Led an organization-wide cloud posture audit and hardened the estate: least-privilege IAM, network segmentation, VPC Service Controls, deny-by-default egress, and a zero-egress serving perimeter.
Detection engineering, container and Kubernetes hardening, and CI/CD security. Built agentic vulnerability triage grounded in deterministic controls, with STRIDE threat modeling across the SDLC.
Platform security engineering at a stealth startup, plus internal and external red-team work. Details generalized to respect confidentiality.
Built an AI system that runs authorized penetration engagements behind a human approval gate, grounding every technique in a security-knowledge corpus and sandboxing an abliterated open-weights model so it can never reach the network or identity it runs on.
Ran an organization-wide posture audit across the cloud estate and drove remediation end to end: least-privilege IAM, network segmentation, VPC Service Controls, and deny-by-default egress, materially raising CIS benchmark compliance.
Locked down self-hosted vLLM serving with per-client RBAC and a strict zero-egress perimeter, then defended the prompt path and model supply chain, blocking a trojaned release and isolating agent tool servers.
Authored a deterministic-first triage pipeline that enriches scanner findings with threat intelligence, scores exploitability against a compensating-control graph, and automates ticket lifecycle and SLAs across thousands of findings.
Selected public tooling. Full source and more on GitHub.
A Rust command-line DNS reconnaissance tool that maps a domain, IP, or CIDR to its subdomains, DNS records, and infrastructure, combining passive OSINT, active brute-force, and zone-transfer discovery into one grouped report.
View RepositoryAdvanced packet sniffer and intrusion-detection system.
View RepositorySTRIDE threat-modeling tool that turns an idea, diagram, or repo into a DFD, threat ledger, scored risk register, and mitigations.
View RepositoryDjango file-based cache manipulation escalated to remote code execution.
View RepositoryA Rust-based Active Directory privilege-escalation framework, currently under development.
Work in progressLDAP3 fork adding Pass-the-Hash / NT-hash authentication for Active Directory tradecraft.
View RepositoryA study of broken access control and security misconfiguration in web-based database applications, walking through live attack demonstrations, impact analysis, and defense-in-depth mitigations grounded in least privilege and secure deployment.
Read the paper (PDF)At Pro Hacker rank, I work hands-on across web, Active Directory, cloud, and privilege-escalation paths. I also captain a competitive CTF team and led Boston University's NCAE CyberGames team to a regional win at the 2025 East Overflow and a fourth-place finish among twelve teams, earning Most Valuable Teammate honors at both the invitational and the regional.
