Security leader and offensive security practitioner (CISSP, CRTO, PNPT; US Navy veteran). I build AI red team and autonomous security programs: multi-agent pentest orchestration, LLM and agent attack-surface testing, and the governance that keeps autonomous tooling safe to run.
Background: Wells Fargo (Offensive Security Research), Altimetrik (Head of Information Security), Apple, Intuit (Product Security / Red Team), PlayStation (Security GRC), Cigital (Red Team), Synack Red Team.
This GitHub is where I publish the public, vendor-neutral side of that work: AI attack tooling, red team playbooks, cloud pentest methodology and small security tools.
In my current role, the autonomous pentest program I run has surfaced 50+ critical vulnerabilities, each ticketed with a reproducible proof of concept, alongside 13 human-supervised AI security agents and 17 automated daily security checks.
- Autonomous AI pentesting, orchestrated. Coordinating open-source AI pentest agents (Strix, PentAGI, Shannon) as one continuous program: multi-agent coordination, scheduled rotation across targets, human-in-the-loop approval gates, and findings that flow into triage only with a reproducible proof of concept.
- Rules of engagement for AI agents. Defined scan windows, no brute force, at most one credential-spray attempt per account, signed scope, full audit logging. Autonomy without guardrails is just an incident.
- Human-in-the-loop agentic security operations. Specialized agents for AppSec PR review, vulnerability and dependency remediation, compliance automation and vendor review, with every risky action behind a human approval gate.
- LLM and agent attack surface. Prompt injection, jailbreak chains, MCP/tool abuse and adversarial ML, alongside AI strategy coursework at MIT Sloan.
| Repo | What it is |
|---|---|
| AI-Redteaming | Curated, dated list of LLM/AI attack tooling: prompt injection, jailbreaks, agentic and MCP threats, adversarial ML |
| Redteam-Runbook | MITRE ATT&CK-mapped red team engagement playbook: scoping/RoE, C2, AD/Entra ID, EDR evasion, purple teaming |
| AWS-Security | AWS penetration testing guide: IAM privilege escalation, S3, Lambda, EKS, cross-account paths |
| BugBountyMethod | Bug bounty / web and API testing methodology with tool-linked checklists |
| jsleaks | Zero-dependency Python tool that finds API keys and secrets in JavaScript |
| codeowner-scout | Maps CODEOWNERS coverage across a repo and scores unowned code |
Open-source projects I run or study (all third-party, linked to their upstream repos): Strix · PentAGI · Shannon · HexStrike AI · Flowsint · NeMo Guardrails
Everything here is for authorized security testing and education only.