DevSecOps · AppSec
DevSecOps & Application Security Engineer
DevSecOps and Application Security Engineer with 7 years in software, 5 in security, focused on automating security at scale. Led a company-wide DevSecOps program at fintech and crypto companies, backed by hands-on pentesting of web, REST/gRPC APIs, mobile, and networks. Builds LLM agents for security automation and assesses AI systems, including MCP servers and guardrails. Peer-reviewed researcher whose HTTP/3 race-condition attack PortSwigger built into Burp Suite's Turbo Intruder.
Peer-reviewed paper introducing the Single Datagram Attack (SDA) for exploiting race conditions over HTTP/3 and QUIC.
PortSwigger implemented our Single Datagram Attack in Turbo Intruder's HTTP/3 engine — HTTP/3 in Burp Suite. Tool: H3SpaceX.
Library built on quic-go for performing the single datagram attack (SDA) against HTTP/3 endpoints.
HTTP/2 single-packet attack library, with a timing feature for exploiting timing attacks and race conditions.
gRPC-Web pentesting methodology and tooling, published as an official PortSwigger BApp Store extension.
Open to talking about application security research, protocol-level attacks and DevSecOps.
Show email address