Security systems built for real operational work.

Problem

Third-party assessments are often slowed by repeated document review, inconsistent judgments, and manual handoffs. I designed this platform to turn that process into a defined engineering system without exposing the employer, vendors, or internal environment it was built to support.

Approach

I built the platform against a 60-item conformance specification and used an adversarial LLM review loop to evaluate vendor evidence and challenge initial conclusions. The implementation combined Python with Claude Code, Cursor, and GitHub Copilot, while keeping assessment logic and review criteria explicit enough to test rather than burying them inside prompts.

Outcome

The work demonstrates how I approach GRC automation: define the control logic, encode the workflow, constrain AI-assisted decisions, and preserve a reviewable path from evidence to conclusion. It replaces an open-ended manual process with a repeatable system that can be evaluated against a specification.

Problem

AI product reviews are difficult when privacy, security, retention, model training, and data-handling claims are scattered across policies and product documentation. Reviewers need a consistent way to compare products without treating a vendor's marketing language as evidence.

Approach

I authored a CC0-licensed specification and applied it to 15 AI products. The work organizes publicly available evidence into a repeatable review of data practices, privacy posture, and security considerations that matter during third-party AI risk and data-protection assessments.

Outcome

The specification provides a reusable baseline for examining AI services and documenting unresolved questions. It demonstrates my ability to translate ambiguous public disclosures into structured requirements that other practitioners can inspect, challenge, and extend.

Problem

Organizations adopting AI often have policies, technical controls, and compliance obligations spread across separate documents. That makes it difficult to understand which requirements are satisfied, where evidence is missing, and what should be remediated first.

Approach

I built Ayliea Assess as a structured self-assessment platform using TypeScript, Next.js, and Supabase. It maps organizational AI security and governance controls to defined requirements, captures evidence, and turns assessment responses into consistent findings and prioritized remediation.

Outcome

The platform demonstrates my ability to turn governance methodology into maintainable software. It connects policy expectations to operational evidence and gives an assessor a clearer basis for evaluating readiness instead of relying on an unstructured questionnaire.

Problem

API and access-control testing requires disciplined coverage across identities, objects, and request paths. Repetitive testing can also hide gaps when the process depends too heavily on memory or one-off scripts.

Approach

My authorized security research focuses on APIs and authorization boundaries. I use purpose-built automation to support repeatable reconnaissance and test preparation while keeping program scope, manual validation, and responsible disclosure central to the methodology.

Outcome

This work demonstrates a methodical approach to offensive research: model the trust boundary, compare behavior across roles, automate repeatable checks, and validate findings before reporting them. No private program names, client details, or undisclosed vulnerability information are included here.

Problem

Vulnerability scanners can produce hundreds of findings, but a small security team still has to triage them, find the right owners, follow up across weeks, manage exceptions, and verify that fixes actually landed. I built Remediation Zero for Google’s All Things Agentic Hackathon to test how much of that long-running operational work an agent system could carry without hiding uncertainty or removing human judgment.

Approach

I designed a seven-part workflow that enriches findings, challenges each proposed decision with a reviewer from a different model family, routes ownership, tracks remediation deadlines, reopens expired exceptions, reconciles rescans, and produces reporting. The implementation uses Gemini, Gemma, Google’s Agent Development Kit, Vertex AI Agent Engine, Model Armor, Cloud Run, Firestore, and GitHub Issues, with separate identities and explicit limits on what each component can change.

Outcome

The public submission demonstrates evidence-driven automation rather than autonomous closure by assertion. In the committed scenario, the system confirms 106 remediations while keeping 102 findings open when scan coverage cannot prove a fix, and the safety and lifecycle behavior is covered by 623 tests. The project was submitted to the hackathon’s Fortified Enterprise Fleet track.