Senior software and security engineer building applied-AI systems for high-stakes workflows.
I have 10 years of software-engineering experience, including two years at Trail of Bits reviewing production systems. At SuperDroids, I build human-reviewable AI tools for code analysis and security review. The systems combine deterministic static analysis, code graphs, read-only MCP interfaces, and constrained agents.
Current focus: AI deployment, developer tooling, and security-critical workflows.
| System | Problem and approach | Public proof |
|---|---|---|
| solidity-audit-graph | Gives coding agents grounded, cross-contract and state-dependency reasoning over Solidity through a Neo4j code-property graph and read-only MCP interface. | 15 MCP tools; database-enforced read-only access; bounded results and timeouts; JSONL traces for tool usage, errors, latency, and dynamic queries |
| meridian | Turns repositories into navigable review workspaces containing code notes, execution flows, attack-surface maps, risk notes, diffs, and diagrams. | Bundled Uniswap V2 fixture; graph and static-analysis integration; incremental cache; end-to-end pre-release workflow |
| rag-hygiene-scanner | Gates retrieval content before indexing by detecting prompt-injection indicators, risky markup, PII, and secret-like strings. | Released CLI; configurable thresholds; JSON/CSV output; CI integration; security and contributing documentation |
| ledgerline | Captures paid agent/API calls, recognizes double-entry revenue, creates tamper-evident commitments, and independently verifies them. | Live Arc Testnet path; idempotent end-to-end demo; balanced journal entries; Merkle anchoring; 14-step verifier |
- Ground model behavior in deterministic tools and structured evidence.
- Keep permissions narrow and consequential actions human-approved.
- Trace model and tool activity so failures can be diagnosed rather than guessed at.
- Treat threat models, failure cases, and operational documentation as part of the product.
- Build for the engineers who must understand, operate, and extend the system afterward.
Before moving full-time into security, I built APIs, integrations, distributed services, and CI infrastructure:
- Led a CI rebuild associated with a 50% improvement in team velocity.
- Designed a distributed job-queue service that reduced infrastructure cost by 95%.
- Shipped API and point-of-sale integrations that opened approximately $112K/year in revenue.
At Trail of Bits and SuperDroids, I have worked directly with engineering teams to turn ambiguous system risks into exploit paths, remediation plans, verification steps, tests, and reusable review tooling.
Selected public work includes Franklin Templeton's tokenized fund, the Immutable zkEVM Bridge, Seaport, Maple Finance V2, LooksRare, Arcade.xyz, MYSO v2, and Primitive Hyper.
See work-sample for public reports and findings.
Applied AI: model APIs, tool calling, MCP, Deep Agents, structured outputs, retrieval, human-in-the-loop workflows
Engineering: Python, TypeScript, Go, Rust, Docker, AWS, GitHub Actions, Postgres, Neo4j / Cypher, REST APIs, distributed systems
Security: threat modeling, static analysis, fuzzing, invariant testing, prompt injection, least-privilege tool design, sandboxing