About
I bring security into how teams actually build.
I work across application security, DevSecOps, and AI security — bringing what’s proven in AppSec into the systems teams are shipping next.
Application Security · DevSecOps · AI Security
Background
I'm an Application Security and DevSecOps specialist. My work sits where engineering and security meet — secure-by-design practices, secure code review, SAST, SCA, DAST, API security, cloud, CI/CD, and vulnerability management.
Alongside hands-on practice, I create security training and author courses, translating real attack and defense work into material engineers can use. Teaching keeps me precise about what actually reduces risk versus what only looks like security.
My current focus is AI-security testing and AI red teaming — applying established security engineering principles to LLMs, AI agents, APIs, CI/CD, and cloud environments.
What ties it together is a simple principle: security must fit how engineers build and ship.
How I think about security
Five principles I keep coming back to.
-
01
Design security in early
Threat model before code ships, not after an incident. The cheapest control is the one designed in from the start.
-
02
Make controls repeatable
A control that depends on one person remembering it is not a control. Encode it into the pipeline and the workflow.
-
03
Test systems the way attackers think
Real assurance comes from adversarial testing — prompt injection, unsafe tool use, API abuse — not checkbox scans.
-
04
Give engineers clear paths to fix risk
Findings without remediation paths create friction, not safety. Every issue should come with a concrete next step.
-
05
Measure what changes risk, not activity
Scan counts and ticket volume are vanity. Track the controls and fixes that actually move the risk needle.
Let's build secure systems together.
Always glad to talk application security, DevSecOps, AI-security testing, and secure delivery — or to share notes from the lab.