Security is how I understand systems.
I build security programs and engineering systems, then write about the decisions, boundaries, and details that make them work.
Building, breaking, and explaining.
I work where software engineering meets security: product security, application and cloud security, software supply chains, and the automation that helps teams make better decisions.
My path has moved from penetration testing and public security research to building security infrastructure and programs inside product companies. That range shapes how I approach a problem: understand the system first, then place controls where they can survive real engineering work.
Writing and speaking are part of the same practice. They force assumptions into the open and turn lessons from incidents, tools, and implementation details into something other engineers can use.
Read what I’m learningWhat shapes my work
Security practice grounded in product context, clear ownership, and tools that fit engineering workflows.
- Product securityBuild controls into the way products are designed and delivered.
- Cloud & KubernetesTreat identity, policy, workload boundaries, and runtime as one system.
- Supply chain securityProtect the path from source and dependency to a trusted release.
- Security automationReduce repetitive analysis while keeping judgment with engineers.