11+ years across penetration testing, cloud security, and DevSecOps — now building the security tooling that watches over AI systems before they ship.
I break applications for a living, professionally and on purpose. Over the last 11 years I've worked through penetration testing, red-team operations, cloud security audits, and DevSecOps pipelines — most recently at IBM, where my focus has shifted toward a newer problem: securing the AI coding assistants and browser-based AI tools that engineering teams are adopting faster than anyone can review them.
I'd rather ship a working control than write another finding no one fixes. That's why alongside assessments, I design and build the tooling myself — DLP browser extensions, proxy-based interception tools, drift-detection platforms — treating security as software to maintain, not a report to file.
The work I'm most known for internally: security controls built as shipped software, not slide decks.
A Manifest V3 Chrome extension built across five phases — prompt and document inspection, data-residency control, governance and managed policy, multi-site coverage, and evasion resistance. Shipped in three editions, including a Teams edition with a Flask + SQLite manager-approval backend. Core design rule: the model itself is never the security boundary.
A local MITM proxy paired with a browser extension, built to prevent data leakage through internal AI coding assistants and browser-based AI tools. Taken through a full internal innovation review — architecture diagram, pitch video, and an AppSec Champion evaluation.
A drift-detection platform monitoring 70+ applications for unauthorized post-approval changes — image digest, SBOM, git SHA, and Infrastructure-as-Code checks. watsonx (Llama 3.3 70B) explains findings; a deterministic engine owns every factual result, so the model stays strictly advisory.
Adversarial testing of an internal AI compliance assistant — surfaced a fabricated-reference-ID technique that flipped risk ratings from HIGH to LOW, plus resistance testing against indirect prompt injection and authority-pressure social engineering.
21 verified credentials from IBM, AWS, Anthropic, and AttackIQ. The seven most relevant to security and AI are featured below — full wall underneath, every one links to its verified Credly record.
Building, integrating, and shipping production applications and agents on Claude — API, Claude Code, custom tools, and MCP servers.
Advising on AI security risk and protecting AI investments across the build lifecycle.
Risk and mitigation across narrow, general, and super AI using MITRE ATLAS and OWASP frameworks.
Zero trust fundamentals and how to lay a zero-trust foundation with IBM Security solutions.
Vulnerability awareness and prevention across the OWASP Top 10 and SANS Top 25 CWE lists.
Building AI-powered applications with watsonx and generative AI tooling, risk-aware by design.
Bias mitigation and AI ethics risk assessment across the Pillars of Trust.
Claude Certified Developer
IBM Consulting — Core Foundation
2026 IBMer watsonx Challenge
Gen & Agentic AI Data Scientist
Trustworthy AI & AI Ethics
Gen & Agentic AI Developer
Security for AI Essentials
watsonx.governance Tech Sales
Industry Jumpstart
Method Essential
Gen & Agentic AI Foundation
IBM Garage Essentials
IBM Growth Behaviors
2025 IBMer watsonx Challenge
Foundations of AI Security
Consulting Way Habits
Zero Trust Principles
DevSecOps Explorer
SPbD Foundations
Think Like a Hacker
AWS Cloud Practitioner
Lead AI & Innovation initiatives across IBM Consulting's security practice — designing watsonx/OpenAI and MCP-integrated tools for vulnerability triage, risk classification, and compliance reporting. Run black-box and grey-box testing and Security & Privacy by Design reviews across internal platforms.
Led penetration testing and risk analytics across web, mobile, and API platforms. Ran AWS security assessments covering IAM, network controls, S3, encryption posture, and Infrastructure-as-Code.
Built a red-team capability from scratch for a major financial institution. Integrated SAST/DAST into CI/CD and built risk & compliance dashboards for leadership.
Application security testing across web, mobile, thick-client, and web-service platforms, with emphasis on payment gateways and transactional flows.
Black-box and grey-box application security assessments; documented findings and verified fixes with engineering teams.
Monitored security logs, analyzed vulnerabilities, and performed static malware analysis for threat research and detection signatures.
Open to security engineering roles and conversations about AI security, cloud security, or penetration testing. The fastest way to reach me is email.