Security engineer focused on agentic AI and offensive + defensive security tooling. I build systems where LLMs and agents don't just generate text — they drive real investigations and attacks: AI-assisted SOC triage platforms, autonomous bug bounty pipelines, and DFIR agents that orchestrate actual tools end-to-end.
I've operated on both sides of the fence:
- Blue Team / DFIR / Threat Intel — Tesla, Palo Alto Networks Unit 42, Duke × Recorded Future
- Offensive Research & Bug Bounty — critical and high-severity findings in large production environments
Current focus: agentic security systems, adversarial AI, attested forensics, and security data pipelines that turn noisy telemetry into reliable decisions and exploits. Right now I'm building AI-native security tooling across the full stack — an agentic Bug Bounty OS, AI-driven SOC triage, and an agentic DFIR assistant — to prove that one person with the right agents can do the work of an entire small security team.
7 repos are public (research + defensive tooling). Advanced offensive/defensive infrastructure remains private — access granted on request. Reach out directly if you're a recruiter, researcher, or potential collaborator.
Languages
AI / ML
Security
Infrastructure
| Project | Description | Stack | LOC | |
|---|---|---|---|---|
| 🔓 | risk-agent | Agentic cyber risk assessment pipeline for Claude Code. 12-stage subagent workflow: scenario in, top-5 prioritized risks with mitigations, residual estimates, and NIST CSF / ISO 27001 / SOC 2 alignment out. Schema-validated artifacts, policy engine, and skeptic pass with human-review flags | Python · Claude Code · Pydantic | 3.4K |
| 🔒 | endpoint-intelligence-agent | Production-grade zero-trust endpoint intelligence platform. Tamper-proof Ed25519 audit logging, WORM storage, Streamlit SOC dashboard, Kubernetes-ready deployment | Python · React · K8s | 30K |
| 🔒 | agentic-soc | Full-stack AI-powered Security Operations Center. 9-stage investigation lifecycle, Claude-driven analysis engine, FastAPI backend, PostgreSQL provenance tracking, Splunk integration | FastAPI · React · TS · PostgreSQL | 21K |
| 🔒 | threat-intel-agent | MCP-backed threat intelligence chatbot. Hybrid semantic search over CVE/NVD data, SBOM processing, multi-LLM support (Claude/OpenAI/local), real-time risk scoring | Python · MCP · Streamlit | 8K |
| 🔒 | dfir-agentic-kit | AI-powered DFIR investigation orchestrator. Arsenal forensic image mounter, hypothesis engine, MITRE ATT&CK automated mapping, timeline reconstruction | Python · Elasticsearch · ATT&CK | 6K |
| Project | Description | Stack | LOC | |
|---|---|---|---|---|
| 🔓 | adversarial-ai-defense | End-to-end adversarial patch attack and defense pipeline for computer vision models. Ensemble defense stack: entropy filtering, frequency analysis, gradient saliency maps, cyberphysical attack simulation | Python · PyTorch | 11K |
| 🔓 | causalguard | Causal, explainable anomaly detection on industrial control system (ICS) telemetry. Evaluated on the SWaT dataset with formal verification and adversarial robustness benchmarks | Python · scikit-learn | 6K |
| 🔓 | lolbin-detection | Living-off-the-land binary (LOLBin) behavioral detection system. FastAPI backend with SQLAlchemy ORM, Streamlit dashboard, Docker-ready | Python · FastAPI · Streamlit | 14K |
| 🔒 | Quantum-Resistant-AI-Algorithm | Post-quantum cryptography parameter optimizer. Genetic algorithm search over Kyber lattice parameters + ML-based vulnerability prediction | Python · React | 3K |
| 🔒 | real-time-voice-cloning | Adversarial audio research pipeline — real-time voice spoofing and deepfake synthesis (SV2TTS architecture). Full encoder/synthesizer/vocoder stack with 5-second speaker adaptation. Built to understand and simulate audio-based attack surfaces for red team and detection research | Python · PyTorch | 7K |
| Project | Description | Stack | LOC | |
|---|---|---|---|---|
| 🔒 | claude-bug-bounty | Autonomous bug bounty agent built on LangGraph ReAct. Multi-provider LLM brain (2,200-line router), intentionally vulnerable demo app for testing, HackerOne MCP server, memory system, scope enforcement | Python · LangGraph · MCP | 20K |
| 🔓 | bugbounty-kit | Production bug bounty operations toolkit. Token scanner, HAI payload builder, RAG knowledge base, hunt journal, audit trail — full pipeline from recon to report | Python · Node.js | 17K |
| 🔒 | malware-lab-orchestrator | Air-gapped malware analysis lab orchestration system. FastAPI orchestrator, Apache Guacamole RDP integration, remote Linux agent runner | Python · FastAPI | 1.5K |
| Project | Description | Stack | LOC | |
|---|---|---|---|---|
| 🔓 | qaca | Synthetic quantum-adaptive crypto-agility (QACA) simulator. Algorithm registry, causal graph analysis, research PoC for post-quantum migration strategies | Python | 3.5K |
| 🔓 | ml-ids-notebook | Machine learning intrusion detection system. Classifier benchmarks across multiple architectures with trained model artifacts included | Python · Jupyter | 3K |
Building production security systems and sharing the work publicly. All offensive tooling is for authorized testing, research, and education only.