Engineering Manager · AppSec
Engineering manager with 10+ years in software engineering. I lead teams, build secure development practices and turn application risks into practical engineering work.
Security Labs
Independent security experiments. Public code and documented evidence.
Three security gates. One working pipeline.
A hands-on lab with Gitleaks, SonarCloud and OWASP ZAP in GitHub Actions. Built against OWASP Juice Shop, with documented failures, fixes and evidence from real pipeline runs.
GitHub Actions → Isolated lab → Published evidence
Defensive security lab
An isolated Cowrie honeypot and Suricata IDS lab, with Alloy, Loki and Grafana for log collection and analysis.
Mobile security lab
An educational InsecureShop lab exploring ContentProvider permissions, APK analysis with JADX and a separate Kotlin app to demonstrate unintended data access in a controlled Android emulator.
Open source
Contributions to tools used by the security community, with the changes and review history open for everyone.
Detection engineering · PR #17027
Added detection templates for Chatwoot, Directus, Grafana Loki and VictoriaMetrics vmagent. Refined matchers and removed duplicate templates during maintainer review.
Cyber Coffee · Writing
RBAC fails over time without regular maintenance. Learn how to model roles around functions, enforce least privilege, conduct periodic access reviews, and maintain auditable access logs.
BOLA occurs when APIs check token validity but fail to verify object ownership. Discover why it tops OWASP lists and how continuous CI testing catches it early.
Prompt injection cannot be patched because LLMs cannot separate data from instructions. True defense requires architecture outside the model: least privilege, treating output as untrusted, and human approval for irreversible actions.
About
Technical depth.
Practical solutions.
Lasting impact.
I’m an engineering manager specializing in Application Security. My background spans infrastructure, full-stack and mobile development, frontend architecture and technical leadership. I work across engineering and security: threat modeling, secure development, vulnerability management and mentoring teams.
Engineering leadership, secure development practices and coordination across software, AI and cybersecurity.
Threat modeling with STRIDE/DREAD, automated security testing, vulnerability reporting and secure-development training.
Technical leadership and security champion work across frontend, backend, mobile and QA; engineering standards and mentoring.
Frontend chapter leadership, React/AEM architecture, testing, observability and engineering practices.
Frontend quality, maintainability and WCAG accessibility.
Engineering management, technical delivery and secure-development practices.
Software architecture, investment platforms, automation and cloud services.
Web and mobile systems, architecture, testing and accessibility.
Migration from native Android/Java to Flutter, mobile architecture and accessibility.
Closed-caption and broadcast engineering systems, documentation and accessibility.
Infrastructure, virtualization, monitoring, cloud backups and service availability.
Technologies
Aikido
OWASP Threat Dragon
Python
Azure
Docker
GitHub
Datadog
SonarCloud
OWASP ZAP
Semgrep
Trivy
Gitleaks
Wazuh
DefectDojo
Linux
Cowrie
Suricata
Grafana
LokiLet’s talk
Let’s talk about application security, engineering leadership, secure development or a technical collaboration.
