Security Engineer · Detection & Agentic Automation
I build security systems, and the AI agents that run inside them.
Not dashboards and tickets. Pipelines, playbooks, and agents that do the work, documented so you can see how.
Selected Work
Systems I built end to end.
Each one is a writeup: the gap, the design, what it actually does.
How I work.
I work the way detection engineering should: start from the adversary behavior, not the alert. I map what I'm defending against to MITRE ATT&CK, write the detection or the automation to close that specific gap, then prove it fires on the thing it was built for and stays quiet otherwise.
Lately that means handing the repetitive parts to agents. An LLM wired into the SOC's real tools, through MCP, can pull the context an analyst would gather by hand and attach it to the alert before a human ever opens it. The interesting engineering is the plumbing and the guardrails, not the model.
The toolkit.
What I reach for, grouped by where it lives.