I’m a Principal Security Engineer + Researcher who designs and scales modern security strategies. Risk ownership, innovation, and leadership across AI, cloud, Kubernetes, and AppSec, proven secure through adversarial simulation.
Get security research in your inbox
Program ownership, guardrails, and adversary-driven validation work.
Security program ownership, AI agent validation, and cloud-native hardening.
Roadmaps, risk framing, executive readouts, and cross-functional execution across AppSec, cloud, data, and AI risk in audit-driven environments.
Threat modeling and adversary-driven validation for MLops, RAG, MCP, and agentic AI systems, including tool access, memory, data egress paths, and guardrail testing.
AWS and GCP security baselines, IAM patterns, logging, and Kubernetes hardening for EKS and multi-tenant clusters.
Secure SDLC enablement with CI/CD enforcement, policy as code, and evidence generation that engineering teams can sustain.
The biggest mistake I see new AppSec leads make isn't technical. It's political. They buy a SAST tool, scan everything, generate 40,000 findings, and wonder why engineering treats them like an adversary by week six.
Last spring I red teamed an AI agent that managed AWS infrastructure. I fed it a poisoned Terraform plan and had full admin access in four minutes. That engagement broke something in my head about how we think about AI security.
Last quarter I got handed a 'production-ready' EKS cluster. 400 pods running as root with hostNetwork, one IAM role with s3:* on the whole account. It had been running this way for eleven months. That's not an outlier. It's the median.
Industry-recognized certifications with verifiable identifiers
Certified Information Systems Security Professional
Certified since 2020
AWS Certified DevOps Engineer - Professional
Certified since 2022
Evidence-first discovery model for agentic AI security that maps topology, trust boundaries, state, memory, permissions, and validation into a repeatable assessment.
Open-source validation harness for LLM and agent security testing with repeatable suites, evidence packs, and exportable reporting.
Need AI security validation, cloud hardening, or leadership insights? Let's talk about building controls that scale with your engineering velocity.
