About
I run production systems in the cloud, and I secure them.
Most people who secure cloud infrastructure have never seen the rack their workload lands on. I have. For the past several years I have worked security operations inside an enterprise data centre — badge access, vendor coordination, equipment flow, and the loading dock during server deployments. I have watched the physical layer of the cloud get built and torn down.
That is an unusual place to start from, and it turns out to be a useful one. Access control, chain of custody, and the gap between a written procedure and what people actually do at 3am are not abstractions to me.
I am now building the engineering side deliberately and in public. Every project on this site states the bar it has to clear before it counts as finished, and nothing gets marked shipped without a repository, a stated result, and evidence you can open. That rule is enforced by the build: a project claiming to be shipped without those three fails validation and the deploy is refused.
This site
The site is a piece of the argument. The source is public. It sets a Content Security Policy with no unsafe-inline anywhere, self-hosts its fonts so no third-party origin appears in the policy, sets no cookies, runs no analytics, and ships under ten kilobytes of JavaScript. You can check all of that yourself.
Scan the headers · Read the source
Contact
Open to security engineering roles.