Defender. Developer. Founder.
I lead AI trust & safety and cybersecurity operations for one of the world's leading AI companies, build vulnerability-triage tooling as the founder of CVERiskPilot, and reverse-engineer hardware and kernels in my spare time — documented across 200+ Hack The Box investigations.
Defender who builds
I lead trust & safety and cybersecurity operations at the point where third-party developers meet a frontier AI platform — and I build vulnerability-triage technology on the side. At Accenture Federal Services I lead a 12-person team (scaling to 20) spanning AI application review, cyber operations, and enterprise support for one of the world’s leading AI companies.
I stood that operation up from scratch — SOPs, onboarding, automated metrics and dashboards — and carried the team through three mission pivots while keeping delivery continuous. My focus is AI-specific threat surfaces: prompt injection, model abuse, data leakage, and emerging agentic-application risks, grounded in vulnerability management, risk assessment, and incident response.
On the side I founded CVERiskPilot, a vulnerability-triage and compliance platform that turns raw scanner findings into actionable decisions. Building it taught me where AI belongs in security — and where it doesn’t: on a six-case adversarial fixture, a fine-tuned model alone matched 16.7% of expected decisions; the same model paired with a deterministic policy layer hit 100%.
- 🛡CompTIA Security+Active
- ⚔HTB Grandmaster · Lvl 98200+ investigations
- 🏰HTB Context Fortress · 7/7Windows/AD · full clear
- 🤖AI Security & Agentic RiskPrompt injection · model abuse
- 🚀NVIDIA InceptionCVERiskPilot
- 🎖Veteran-Owned · SDVOSB-eligibleTexas-registered
CVERiskPilot
An AI-driven vulnerability-triage and compliance platform that turns raw scanner output into prioritized, explained remediation — ingesting 11 scanner formats, enriching with CVE/EPSS/KEV, and mapping controls across 13 frameworks, behind a tamper-evident signed audit trail.
cveriskpilot.com →What I work on
Track record
- Lead a 12-person cybersecurity & AI trust-and-safety team (scaling to 20) reviewing third-party AI applications for one of the world’s leading AI companies.
- Stood up the operation from scratch — 10 SOPs, onboarding, and automated dashboards — through three mission pivots with continuous delivery.
- Built an AI-driven vulnerability-triage platform ingesting 11 scanner formats, enriching with CVE/EPSS/KEV, and producing prioritized, explained remediation.
- Tamper-evident signed audit trail (Ed25519 + Merkle), multi-tenant RBAC/ABAC, control mapping across 13 compliance frameworks.
- Helped build and test an agentic application automating review of security reports for federal use cases.
- Ran app/container security reviews across DAST, SAST, OSS/SBOM, JFrog, Prisma, Grype, and Wiz; redesigned the POA&M workflow.
- Administered patch management for 2,000+ DoD medical devices (CONUS/OCONUS); maintained FDA/DoD compliance.
- Triaged Splunk alerts and drove incident response; malware analysis, forensics, and ACAS vulnerability review.
- Led small-team logistics, training, and operational readiness in high-accountability environments.
Write-ups, by category
Selected retired Hack The Box work across offensive machines, blue-team DFIR, and hardware/firmware — flags and credentials redacted, techniques described.
Offensive · Machines
5Full-chain compromises — web, RCE, credential reuse, kernel.
Bike
Very EasyHandlebars SSTI in a Node.js/Express app, escaped to command execution via Node global objects (process.mainModule.require) — and because the service runs as root, RCE lands as root.
Nexus
HardFull-chain Linux compromise: a secret in public git history, authenticated file-upload RCE, credential reuse into SSH, and root via a path-traversal flaw in a root service.
Strutted
MediumApache Struts 2 file-upload RCE (S2-067) for a foothold, credentials lifted from live Tomcat config, then root via a GTFOBins technique on a sudo-allowed tcpdump.
Devvortex
EasyA Joomla config-disclosure CVE chained into authenticated template RCE, DB credentials cracked to a shell, and root through a vulnerable sudo apport-cli.
Analytics
EasyA Metabase pre-auth RCE, environment credentials pulled from the container, then root via the OverlayFS “GameOver(lay)” kernel bug.
Blue Team · DFIR
3Memory, disk and triage forensics; reconstructing the intrusion.
Midnight Crash
MediumKernel crash-dump forensics: reading a NULL-pointer panic back to a malicious loadable kernel module hiding behind a fake /proc entry, using the crash utility.
Kernel Exploit
EasyReconstructing a local privilege escalation from a Linux triage collection and tying it to CVE-2024-1086, the nf_tables use-after-free that yields root.
Linux Forensics
EasyDisk-image forensics of an insider-threat case on a mounted Linux filesystem — reconstructing intent, actions, and the artifacts left behind.
Hardware, Firmware & Reversing
3Firmware carving, EEPROM/U-Boot, bootkits and low-level RE.
Convoluted Boot
HardA four-stage boot-chain backdoor — MBR bootkit, kernel, libc and busybox — reversed end to end: PXE netboot bring-up, a version-pinned iPXE gotcha, and a z3 break of the final password checker.
Photon Lockdown
Very EasyFirmware reverse-engineering: carving a fiber-router (ONT) SquashFS image with binwalk and recovering the device’s default administrator configuration.
U-Boot EEPROM Split-Secret
From a raw U-Boot boot prompt, recovering a secret split across two I²C EEPROMs — encrypted env in one chip, key material in another — decrypted offline.
Platform Security · Defense
1Secure/measured boot and TPM — the defensive side of the badge.