home / overview
About
From networking and IT, through ethical hacking and AI engineering, to the boundaries that make systems trustworthy.
I started in freelance networking and IT, moved into breaking things for clients, spent years building software and AI systems, and now research what makes a system trustworthy.
That mix shapes how I work. I read the engineering as closely as the exploit, and I document decisions, trade-offs and outcomes so others can verify them.
What I research Current venturesCareer timeline
2012 to now- 2024 – present
Founder, AI Architect & Security Researcher
Co-founded Plank Designs in 2024 as Chief AI Architect and founded Souverain Labs in 2025 as AI Architect and Security Researcher. Research on reproducible, isolated and security-boundary systems, plus web and AI security. See the resume.
- 2023 – 2024
Data Scientist & AI Engineer
Worked on machine learning and AI systems, which raised the security questions around models, agents and the infrastructure that runs them.
- 2018 – 2023
Software Engineer
Built and shipped production software, learning how systems are designed, deployed and maintained from the inside.
- 2014 – 2017
Freelance Ethical Hacker
Conducted authorized offensive security assessments across Windows, Linux, wireless networks, and identity infrastructure, identifying vulnerabilities, misconfigurations, privilege-escalation paths, and attack vectors. Much of the Windows work was recovering system files and passwords and testing security, while the Linux work went deeper into finding holes and patching them, with web hacking when a client needed it. Findings were written up as reports people could act on.
- 2012 – 2014
Freelance Networking & IT
Freelance work in networking and IT for clients: the practical groundwork in how networks and systems are built, run and supported.
Approach
how I workModel the trust boundary.
What does the system assume, what can cross the boundary, and what happens when it does?
Prove it, minimally.
Smallest reproduction in an isolated, reproducible environment. No real data, no collateral.
Disclose on a clock.
Report, acknowledge, patch, publish. 90 days unless agreed otherwise.
What I can help with
areas of workWeb and API security review
Authentication, access control, SSRF and injection on modern stacks, reported with a minimal reproduction and a fix.
02AI security
Agents, tool-output injection and unsafe model loading: where models and the systems around them trust too much.
03Detection engineering
Sigma, Splunk SPL and Sentinel KQL rules mapped to MITRE ATT&CK, each with its false positives written down.
04IAM and SOC operations
Joiner, mover, leaver lifecycles, cloud identity and access management, alert triage and escalation, drawn from real operational work.
Toolkit
the short version · full list on the resume- Security
- Web & API securityAI securityThreat modellingDetection engineeringMITRE ATT&CKIncident responseIAM
- Engineering
- RustGoPythonZigSQLReact
- Systems
- NixOSVoid LinuxFreeBSDKVM/QEMUnftablesDockerGCP IAM
- AI & data
- PyTorchTensorFlowScikit-LearnPandas
Learning and credentials
Certificates and coursework are listed on the certifications page. That includes a Codecademy certificate in Google Associate Cloud Engineer: Identity & Access Management (IAM), and the badges I am working toward: Cisco Network Security, Cisco Endpoint Security, TryHackMe Pre-Security and TryHackMe Security Engineer, all pending. What I am studying this month is on the now page.