Technical writing on Windows internals, reverse engineering, and security engineering.

I build low-level telemetry, detection, and hardening capabilities intended for production environments and real attacker behavior.

• Kernel- and user-mode endpoint components in modern C++
• Behavioral detection for shellcode injection and exploit activity
• High-fidelity telemetry pipelines with practical cost discipline

Experience building and assessing offensive tooling informs the defensive side of my work and keeps it grounded in operator reality.

• Implants, loaders, and command-and-control support tooling
• Threat modeling and OPSEC-aware engineering
• Cross-platform evasive research spanning Windows, macOS, iOS, and Linux

When a system is opaque, I am comfortable working at the binary level until the relevant behavior is understood.

• Binary manipulation and malicious subversion analysis
• Compiler, supply chain, and code-injection research
• Exploit development and root-cause driven security analysis

I work at the intersection of architecture, tooling, and engineering process, especially where mature codebases need to become faster and safer at the same time.

• Agentic and AI-assisted engineering workflows for large codebases
• Testing and CI improvements under operational constraints
• Hardening reviews against advanced attacker techniques

Leading Windows agent and EDR platform work across kernel and user mode, with a focus on exploit-aware telemetry, defensive hardening, and practical platform modernization.

• Architected enterprise EDR capabilities across kernel and user mode
• Established AI-assisted workflows and engineering standards across a large legacy codebase
• Built crash-dump and behavioral-analysis utilities for production defense

Developed advanced CNO tooling and led research into evasion, anti-analysis, and validation infrastructure across multiple operating systems.

• Built implants, loaders, and supporting command-and-control infrastructure
• Researched hypervisor-based and hardware-assisted evasion techniques
• Introduced automated testing and CI patterns inside constrained environments

Worked across red- and blue-team assessments, supply-chain research, vulnerability analysis, and technical reporting for senior stakeholders.

• Contributed to work referenced in senior-level cyber policy discussions
• Researched SolarWinds-class attack paths and defensive replication strategies
• Performed reverse engineering, application security audits, and tool evaluation