I'm a software engineer specializing in Software Supply Chain Security Research, Application Security, and Developer Security (DevSec).
I help AI-first founders build and ship secure products at startup speed.
I have 9 years of experience designing, building, and securing software, with a focus on:
- Software Supply Chain Security — Investigating malicious open-source packages, malware analysis, and detection engineering.
- Threat Research — Tracking attack campaigns, particularly DPRK-linked threats targeting developers and open-source ecosystems.
- Application Security — Vulnerability research, security testing, and secure software development.
- Developer Security (DevSec) — Securing developer workstations, development workflows, and containing threats from untrusted code and AI coding agents.
- AI & Agentic Security — Exploring AI-driven development, securing autonomous coding agents, and managing the risks of AI-assisted software engineering.
I've spent most of my career building software, and more recently, security tools and researching threats. I work with TypeScript, Python, and Go, and am constantly building AI workflows for software development and threat detection.
I currently work at a Sydney-based offensive security firm, where I combine software engineering with an attacker's mindset to identify weaknesses, understand how adversaries exploit them, and build tools and defenses to detect and contain threats.
I approach security from an engineering perspective: understanding how software is built, how it breaks, and how to make it safer.
- Are you a founder building something with AI?
- Engineer interested in agentic AI security and sandboxing?
- Have a security problem you need some input on?
I'd love to hear about it!