01 — Now
Updated 2026-07-30The day job is offensive security at a major cryptocurrency exchange: application security, and lately the AI tooling that is starting to do parts of that work. Vuln discovery with AI is the easy part, finding the right things to look for is where it gets interesting.
The AI part is not a recent development. I was running a language-model chatbot in a Discord server in 2021, back when getting access to one still meant a research application. The homelab has been the proving ground ever since; right now it runs an agent that repairs my own infrastructure, so I can be wrong about agentic systems somewhere the stakes are a weekend rather than a company.
I’m starting to write about this in public. The essays will land here when they are worth reading.
02 — The path
Roughly a decade, in three parts: enterprise database engineering at Oracle, security and risk consulting at a global management consulting firm, and now offensive security engineering at a major cryptocurrency exchange. The pattern is that I keep ending up where the security work is being rebuilt, and the program is in need of a fresh perspective from a problem solver.
03 — On the record
Fifth Circuit · No. 23-50669 · Nov 2024
I was one of six named plaintiffs in the suit challenging OFAC’s sanctioning of Tornado Cash’s immutable, open-source smart contracts. The Fifth Circuit agreed: immutable code is not “property” under IEEPA. Striking the sanctions set precedent for what open-source code is allowed to be.
Named contributor · 2024
Named contributor. Early champion of GenAI security challenges, I collaborated with Lakera to define and document the industry discussion around GenAI adoption and safety.