I secure the production AI platform I built and operate.
Nearly six years helping build a major bank's Application Security program, with SAST, DAST, and SCA in developer pipelines and IDEs. Since 2023 I have built and operated my own production AI ops platform and secured it with controls mapped to the OWASP Top 10 for LLM Applications: prompt-injection defenses at the gateway, generated-code scanning, tool-permission boundaries, and a kill switch that halts the agent. Now I want to go deep inside one team.
- Security is my background, so I build controls into the pipeline instead of bolting them on.
- I secured my own AI platform with controls mapped to the OWASP LLM Top 10: prompt-injection defenses, generated-code scanning, and tool-permission boundaries.
- The agent cannot merge or deploy. It can only label a pull request, and a workflow with size caps, protected paths, and required checks decides what merges.
- I want to bring this security-first way of building into a team.
Nearly six years in application security at a major bank, embedding security testing directly into developer pipelines, so controls live in the pipeline by default.
My own production AI ops platform
An agent diagnoses failures and drafts fixes as pull requests. It cannot merge or deploy on its own. Controls are mapped to the OWASP LLM Top 10: prompt-injection defenses, a generated-code scanner, a protected-path denylist, tool-permission boundaries, and a kill switch that halts the agent.
How it works →A live, always-on financial product
An on-chain product where a security bug means real financial loss: 12 smart contracts in production handling real money, plus the transaction-integrity and reconciliation checks that keep it honest.
Get in touch
Open to application security, product security, and AI/LLM security roles, full-time or contract, in Toronto or remote Canada. Grab a time on my calendar, or find me on LinkedIn.