Skills, tooling, and workflow

This list mirrors the core capabilities from my CV and day-to-day work in application security, red teaming, and security engineering.

Offensive security focus

  • Application and network penetration testing

    White-box and adversary-style testing focused on attack paths, exploitation feasibility, and practical remediation.

  • Privilege escalation and lateral movement

    Post-exploitation workflows for validating blast radius and identifying opportunities to contain adversary movement.

  • Red, purple, and assumed-breach exercises

    Collaborative simulations with SOC and engineering teams to improve detections, response logic, and operational resilience.

Engineering and automation

  • Custom exploits and automation scripts

    Purpose-built tooling to support assessments, speed up repetitive checks, and provide high-signal proof-of-concept material.

  • Payload and evasion R&D

    Testing custom payloads and loaders with focus on antivirus and EDR bypass where technically and ethically appropriate.

  • Security scanning pipeline ownership

    Managing SAST, SCA, and DAST integrations, including result triage, false-positive reduction, and PR-level feedback loops.

Languages and infrastructure

  • Programming languages

    Python, Go, C#, Rust, PowerShell, PHP, and Java.

  • Infrastructure and deployment

    Ansible-driven C2 infrastructure, lab-first validation workflows, and secure-by-design collaboration with engineering teams.

  • Communication and leadership

    Cross-functional collaboration across engineering teams and C-level stakeholders with clear, actionable risk communication.