I build security projects across the defensive loop: collecting cloud and workload telemetry, turning it into analyst-ready detections, and prototyping human-approved response automation. My software background includes leading development of MyFitPlate, a native iPhone and Apple Watch app shipped on the App Store, and my research includes a peer-reviewed IEEE paper on mobile application security and privacy.

I am pursuing application security, mobile security, cloud security, detection engineering, security automation, DevSecOps, and SOC opportunities.

A production SwiftUI application for nutrition, training, recovery, and evidence-aware coaching. The public repository documents its iPhone and Apple Watch architecture, Firebase and Cloud Functions backend, privacy and security controls, migrations, and automated test suites. View it on the App Store.

An open-source iOS-first security research toolkit extending my IEEE mobile-app study into a SwiftUI iPhone app and Python scanner. It combines app privacy activity, supplied package and source evidence, guided checks, and version comparisons into evidence-linked reports and conditional attack-path tests. The prototype has 53 passing Python tests and 9 passing Swift core tests; physical-iPhone workflow validation is still in progress.

A deliberately split supply-chain security case study. It preserves an isolated vulnerable Flask target for teaching evidence while a separate remediated application is protected by tests, Bandit, repository policy checks, and blocking HIGH/CRITICAL Trivy gates. The supporting Terraform and Kubernetes examples use hardened defaults and disclose their decommissioned, reference-only status.

A completed and decommissioned Cowrie and Conpot study used to analyze real SSH, Telnet, and ICS/SCADA activity in Splunk. Its public evidence package withholds raw identifiers, credentials, commands, and payloads while preserving auditable aggregate results.

A detection-as-code portfolio with versioned AWS IAM, AWS root, PowerShell, and LSASS hypotheses; synthetic malicious and benign fixtures; a dependency-free matcher; regression tests; and analyst triage playbooks. The checked-in results report four expected fixture matches with no fixture false positives or false negatives, without presenting synthetic validation as production efficacy.

A serverless response case study with authenticated webhooks, replay resistance, explicit incident states, human approval, scoped IAM roles, and containment verification. Sixteen tests cover success and failure paths; the original IAM AccessDenied outcome remains documented as negative evidence instead of being rewritten as a successful containment claim.

These projects show how I move from controlled experimentation to product engineering: preserve negative evidence, identify the reliability boundary, and encode that lesson into deterministic, observable software.

A completed recurrent-PPO study with procedural solvability checks, disjoint evaluation suites, checkpoint integrity, and preregistered promotion gates. Strong average capability did not eliminate rare catastrophic interaction loops, so the study closed without promoting an unreliable architecture.

A completed systems-rich vertical slice where players compose party playbooks, seal orders, observe autonomous expeditions, and audit evidence-grounded outcomes. The deterministic simulation remains independent of rendering, playback speed, and UI state.

A completed study of whether one randomly initialized recurrent visual policy could turn self-generated experience into cumulative game skills. V12 processed 8.24 million actions across four emulators and replay-verified seven milestones through Route 1, yet frozen evaluation ended at 55/502 with zero retained competent skills and no composition—evidence that discovery and training activity are not the same as durable competence.

Co-author, “A Security and Privacy Assessment of Mobile Ride-Sharing Applications,” IEEE SoutheastCon 2026. DOI: 10.1109/SoutheastCon63549.2026.11476248

CompTIA Security+ · Splunk Core Certified Power User · AWS Certified Cloud Practitioner

• Separate observed evidence from inference.
• Prefer reproducible code, tests, and sanitized data over screenshots alone.
• Keep risky actions human-approved and record failure honestly.
• Destroy temporary cloud and honeypot infrastructure after evidence collection.

The work shown here includes production software, research prototypes, and controlled security labs. Completed cloud and honeypot infrastructure was dismantled after evidence collection.