Security engineer in Chicago, working in high-frequency trading.
I like the awkward edges of real systems: authentication boundaries, parser behavior, and state that doesn't get cleaned up.
My rule is simple: find the weird edge case, prove it, fix it, and leave a regression test.
- parsedmarc — reported a High-severity remote CPU-exhaustion issue in the legacy failure-report parser. Publicly credited as reporter; patched in
11.0.4. - Rapid7 — fixed relay scheduler cleanup between runs in rex-core and MSSQL login scanner client cleanup in Metasploit Framework. Both merged.
- osquery — fixed
chrome_extensionsstate for modern Chromium profiles. Merged.
For more contributions and their current status, see my pull requests.
I write about security decisions people actually have to make.
- Infrastructure as Code: An IaC Guide to Cloud Security — Dark Reading
- Rethinking Our Approach to SIEM: Stop Collecting Everything — ISC2 Insights
- How to Focus Vendor Security Reviews on the Risks that Matter — SecureWorld
More: Dark Reading · SecureWorld · LinkedIn
If this kind of work is your thing, follow along.