Background
I work in application security at an enterprise level — web and API penetration testing, threat modeling, and building the automation that makes security scale across large engineering organisations. Most of my time is split between hands-on offensive work and building tooling that compresses the manual overhead that comes with running security programs at scale.
Connect on LinkedIn or view my résumé.
Threat modeling
Threat modeling is the highest-leverage point in the SDLC. A design flaw caught before code is written costs almost nothing to fix. The same flaw found in production is expensive and often stays around longer than it should.
I run threat modeling sessions with engineering teams during design reviews — STRIDE-based, focused on trust boundaries, authentication flows, and data handling. The output that matters is a shared understanding of where the risk is, not a document that gets filed away.
Penetration testing and DAST
I do manual web application and API penetration testing — business logic flaws, authorisation bypasses, authentication weaknesses, injection vulnerabilities. The kind of testing that automated scanners miss because they can't follow application logic.
On the automated side, I build and maintain DAST pipelines integrated into CI/CD. The goal is continuous coverage, so findings reach developers on every deploy rather than in a quarterly engagement report that's already out of date by the time it's read.
AI-driven security automation
Security teams spend a significant amount of time on work that shouldn't require a security engineer — writing up findings in a standard format, triaging low-signal alerts, prioritising a backlog of vulnerabilities by severity. I build tooling that handles that automatically so engineers can focus on the work that actually requires judgment.
I also work in AI/ML security specifically — adversarial attacks, prompt injection, and the attack surface that AI systems introduce that traditional AppSec tooling doesn't cover. My C-AI/ML certification covers this directly.
Home SOC lab
AppSec gives you a detailed view of how vulnerabilities get introduced. It doesn't give you much visibility into what detection looks like once something gets through.
I'm building a home SOC lab to close that gap — Security Onion, Wazuh, Sysmon, Atomic Red Team, TheHive, MISP, and Velociraptor. I run ATT&CK techniques against a Windows victim VM and hunt for them in the SIEM. The whole thing is documented at the SOC Lab blog.