About

I have an 8-year background in offensive security. I actively participate in Capture The Flag (CTF) competitions and regularly attend cybersecurity conferences including BSides, DC4420, and hack::soho.

What I Do

Day to day, my client-facing work covers:

Web application penetration testing: black and grey box engagements.
Open-Source Intelligence (OSINT): reconnaissance and infrastructure mapping for engagements.
Reporting and remediation: OWASP-aligned writeups with CVSS v3.1 scoring, client debriefs, and follow-up retests.
Custom tooling: small scripts and utilities that come out of repetitive engagement work.

Outside of paid engagements, I’ve spent time in training and mentorship on Active Directory and Linux exploitation, post-exploitation tradecraft, and malware analysis, working in sandboxed enterprise environments alongside red teamers.

What I’m Really Into

If I could pick, I’d spend my time on Command-and-Control (C2) infrastructure, malware development, and exploit development in Python, JavaScript, C, and C++. Callbacks, loaders, beacon comms, post-exploitation tooling.

I’m also into the overlap between offensive and defensive security: how detection forces malware to change, what defenders actually catch, and how offensive research feeds back into defensive work.