Security researcher · Product & technology leader · Systems builder
I've spent my career exploring, building, and breaking software systems—from low-level instrumentation and vulnerability research to distributed platforms, products, and engineering organizations. I'm happiest working on hard problems, especially ones that challenge how we think software should work.
I'm Chief Product & Technology Officer at NowSecure, working across product strategy, engineering, and security research. I love building teams and turning ambitious technical ideas into useful products, but I still make time to experiment with code.
I'm particularly drawn to ideas that change how we build software—not just what we build. These days, that means AI agents, live and inspectable development environments, automated security research, and programming systems that make complexity more manageable.
- AI-native development environments: What changes when an agent can inspect live objects, state, and execution—not just read and edit files?
- Security research at scale: How can automation, instrumentation, and AI help us investigate real systems more deeply, reproducibly, and safely?
- Tools for thinking: How can better introspection, feedback, and representations help humans and agents understand complex codebases?
- Resilient software systems: I'm especially interested in Erlang/Elixir, Smalltalk/Pharo, databases, distributed systems, and practical developer infrastructure.
- gtoolkit-acp — An Agent Client Protocol client for Glamorous Toolkit. Run coding agents inside an inspectable environment, with sessions, permissions, messages, and tool activity represented as objects you can explore.
- mygtmcp — An MCP bridge that lets agents interact with a live Glamorous Toolkit/Pharo image. An experiment in moving agents beyond text-only interaction with code.
- db_sampler — An Elixir tool for sampling PostgreSQL data, built for the practical work of understanding and testing data-intensive systems.
- awesome-frida — A curated collection of projects, tools, and resources for Frida, the dynamic instrumentation toolkit.
- mobile-security-skills — Agent skills for mobile application security testing, bringing domain-specific guidance into AI-assisted security workflows.
- canary — A small macOS filesystem honeypot written in Go. It plants decoy secrets and alerts when they're accessed—an experiment in lightweight detection.
- deps_checker — Dependency-risk checks for mobile applications using software bills of materials (SBOMs).
Many of my other repositories are experiments, prototypes, and explorations rather than polished products. I keep them public because unfinished ideas can still be useful to someone else.
I occasionally publish investigations and technical write-ups that connect hands-on research with broader security questions. A few examples:
- The two-second ad auction you never see — Examining the reach of a mobile advertising SDK and the privacy-relevant signals observed in real applications.
- California's data brokers, inside your phone — Cross-referencing California's registered data brokers with observations from a large sample of mobile applications.
- NowSecure Labs — More public, evidence-driven mobile security research.
My work spans security research, software engineering, product management, and technical leadership. At NowSecure, I've helped lead teams developing mobile application security and risk-management technology. Earlier, I worked in security and vulnerability research at MITRE and the Institute for Defense Analyses. My work has included vulnerability research, patents, and presentations at security conferences, including IEEE Security & Privacy, RSA, and Troopers.
The thread connecting these experiences is a desire to understand difficult systems deeply—and to build tools and teams that make hard problems tractable.
I enjoy talking with researchers, engineers, and founders tackling ambitious problems in AI, cybersecurity, developer tools, and systems infrastructure. I'm especially interested in unconventional approaches, early prototypes, and collaborations where there's still a lot to figure out.
If you're working on something along those lines, I'd love to hear what you're building.