Break it on purpose
Scoped, rules-of-engagement work that approaches your stack the way an intruder would: recon, initial access, lateral movement. The report names the control that failed and the first thing to change.
independent security operator
I break systems before someone else does.
Offensive research, zero-trust architecture and privacy engineering for teams that would rather find the hole themselves — from private companies to government-level programmes. DevOps by trade. Attacker by curiosity. Architect by necessity.
operational · select engagements open
offensive research
zero trust
threat modeling
privacy engineering
devsecops
government-level work
01
What I do
Trust nothing by default
Identity-first design across cloud and on-prem. Every request authenticated, authorized and logged, with segmentation that survives a stolen laptop — not just a compliance checklist.
Make it hold
DevOps and SysOps cleanup, Android and endpoint hardening, and incident runbooks written for the person who is actually on call at 3 a.m.
02
Operating principles
-
01
Consent is the perimeter.
Every engagement starts with a signed scope and explicit rules of engagement. No exceptions, no stray packets, no “we’ll ask later.”
-
02
Evidence over vibes.
Findings are reproducible: command, timestamp, impact. If I can’t show you exactly how it breaks, it doesn’t go in the report.
-
03
Privacy is not a feature.
Collect the least data required, hold it for the shortest time, and delete it on schedule. Your attack surface is not my content library.
Got a system that needs a second opinion?
Start with a short briefing: what it does, what worries you, and when it needs to be fixed. That’s enough for a first pass.