home / where-to-start
Where to Start
Five ways in. Pick the path that matches why you are here, and you land on the right thing in one click.
Pick your path
hiring · research · detection · engineering · client work01 · hiring
For recruiters & hiring managers
Evaluate the technical background, the professional work, and the evidence behind it.
- Resume →Experience, skills and certifications, plus a PDF.
- About →Career timeline: networking and IT, pentesting, software, AI, research.
- Certifications →Earned certificates and the badges in progress.
- Contact →Reach me; the form is the only inbound path.
02 · research
For security researchers
Read the findings, the threat models they are scoped to, and the lab they are reproduced in.
- Findings →Web and API vulnerabilities with impact, root cause, mitigation and a timeline.
- Research →OS, kernel, isolation, air gaps, reproducible builds, boot and trusted computing.
- Threat models →The assumptions and attacker model each finding is written against.
- Home lab →Isolated and cloud-identity ranges used to reproduce proofs of concept without real data.
03 · blue team
For detection & incident-response teams
Detection rules and operational case studies, mapped to MITRE ATT&CK and tested in the lab.
- Detections →Sigma, Splunk SPL and Sentinel KQL rules, each with its false positives written down.
- Incident response →Case studies with timeline, role, actions and the improvements they led to.
- Detection playground →Try the rules against sample events in the browser.
- Test ranges →How the isolated and cloud-identity ranges are wired for testing.
04 · builders
For engineers & AI builders
The systems and tooling I build, and the security of the web and AI stacks around them.
- Projects →Rust, Zig, Go and Python: a Wayland compositor, a sandbox runner, a build verifier and more.
- Web security →Authentication, access control, SSRF and injection on modern web stacks.
- AI security →Prompt and tool-output injection, agent trust, and unsafe model loading.
- NixOS →A reproducible, declaratively configured system, tools chosen on purpose.
05 · client work
For clients & collaborators
Understand what I can help with, how I approach the work, and how to start a conversation.
- What I can help with →Web and API security review, AI security, detection engineering, IAM and SOC operations.
- Selected work →The problem, constraints and decisions behind each build.
- Ventures →The companies I co-founded and the work they do.
- Contact →Start a conversation; encrypted reports are welcome.
Not sure where you fit?
shortcutsSearch the whole site by keyword, read the newest short notes, or just get in touch.