I build security into the structure of software — threat models before features, guardrails instead of gates, and detections that tell a clear story at 3 a.m.
Who, what and why
Security engineer with nearly a decade of experience securing cloud-native platforms, payment systems and developer tooling.
My work sits between engineering and defence. I partner with product teams to threat-model new services, design identity and secrets architecture, and ship paved-road tooling that makes the secure option the easiest one. On the defensive side I build detection pipelines, write and tune rules, and run incident response when things go wrong.
I believe good security is mostly good engineering: clear boundaries, least privilege, measurable controls and honest post-mortems. I prefer reducing an entire class of vulnerability over chasing individual findings.
Disciplines and instruments
Secure code review, SAST/DAST in CI, secure SDLC, OWASP Top 10 & ASVS, design reviews for APIs and auth flows.
AWS and GCP hardening, IAM least-privilege, Kubernetes security, policy-as-code and infrastructure-as-code scanning.
Detection-as-code, SIEM engineering, log pipelines, incident handling, forensics triage and tabletop exercises.
STRIDE and attack-tree based reviews, abuse-case design, risk scoring and architectural guidance for product teams.
OAuth 2.0 / OIDC, SSO, mTLS, secrets management, key rotation and practical applied cryptography.
Tooling and bots that scale the security team — triage pipelines, guardrails, self-service reviews.
Three projects, documented
Replaced long-lived administrator roles across 60 AWS accounts with just-in-time, approval-based access. Engineers request scoped sessions via chat; every grant is time-boxed, logged and tied to a ticket.
Built the broker in Go with policy decisions in OPA, integrated with Okta groups and the on-call schedule for break-glass.
Moved 300+ ad-hoc SIEM searches into a version-controlled repository of Sigma rules with unit tests, synthetic attack replays and peer review. Every rule maps to a MITRE ATT&CK technique and ships with a runbook.
Coverage gaps are now visible on a single matrix, and false-positive rates are tracked per rule like any other service-level metric.
Designed a lightweight secure development lifecycle: risk-tiered design reviews, custom Semgrep rules for the company's own frameworks, dependency and secrets scanning on every pull request, and a self-service threat-modelling template.
Findings arrive as inline review comments with a fix suggestion, not as a PDF report three weeks later.
Professional experience
Fintech payments platform
E-commerce group
Security consultancy
Managed hosting provider
Direct lines, no forms
Let's make the secure path the easy one. Write to me →
Found a vulnerability in a system I maintain? Please report it by email first; I acknowledge every responsible disclosure and credit researchers where possible.