A short version
I started as a security researcher at Carnegie Mellon's CERT, broke Tor protocol headers on a budget, ran Incident Response inside a global bank's fusion center, and led the R&D team at HUMAN Security whose detection system now blocks over 200 million malicious bots a day without a human in the loop. Today I'm Principal Security Engineer and Chief Technical Advisor at NDay Security, building agentic security tools that act on findings instead of just producing them. The technical details and the boardroom consequences both matter to me, and I've put in the work to speak to each.
Foster the team A healthy security department grows from strong leadership that listens and shares.
Own mistakes Mistakes happen. What you take from them decides what happens next.
Governable autonomy If you don't understand what you've built or how it works, you haven't brought much value.
Telemetry over intuition Detection engineering is a data problem. Gut calls are for the first 30 seconds of triage, not the postmortem.
Communicate effectively Answer questions honestly and deliver actionable intelligence to stakeholders.
Fundamentals matter Typed interfaces, least-privilege IAM, ephemeral sandboxes. Most of what makes a system secure starts from the basics.
Architecting AttackBench at NDay Security — an autonomous pentesting platform with safety built in from day one, aligned to the OWASP Autonomous Penetration Testing Standard. Publishing open-source security tooling: MCP servers for offensive work and an AI-agent honeypot. Studying the future of Agentic AI, and advising executives on what's coming next.