Solutions Architect and Agentic AI Engineer
I design and run security engagements for enterprise customers, build the telemetry and identity plumbing that makes them work, and spend the rest of my time on agentic AI systems and how to measure them honestly.
Hover or focus to pause. Logos are trademarks of their owners and indicate tools used, not endorsement.
Each of these is something I have shipped for a paying customer or run in production for myself. Grouped by the problem they solve, not by the vendor.
Getting the right logs into the right place, cheaply, with detections that hold up. Log source onboarding for CrowdStrike Next-Gen SIEM, Panther, Google SecOps, and Elastic. Cloudflare Logpush and Qualys integrations. Cribl and vector.dev pipelines to cut ingest cost. MITRE ATT&CK coverage mapping. Diagnosed Elastic shard exhaustion on a live university cluster and drove the fix.
Author of claude-otel, an open-source OpenTelemetry collection and SIEM export pipeline for Claude Code sessions: prompts, tool calls, token and cost totals, session-level JSONL to S3 with KMS and short-lived Vault credentials. A customer chose it over their SIEM vendor's native option. Also: OTel collector configuration, Jaeger tracing, Datadog ingest cost tuning.
Okta Universal Directory, group rules, and HR-driven provisioning. Rewrote a pharmacy benefits manager's Workday-to-Okta model: composite department attributes and about 239 dual-value group rules so access stayed stable through cutover. Reconciled an 8,000-field environment delta down to the 47 objects that mattered. Active Directory forest migration work, including WinRM remediation on domain controllers. Google Workspace to Okta migration tooling with zero-impact password import.
Authored a multi-phase AWS Control Tower plan for an internal landing zone built as a reusable harness: Security Hub, Audit Manager, SCP rationalization, IAM Identity Center, vendor log control plane, and a 49-row preflight checklist with an evidence bundle. Drata SOC 2 readiness audit. GitHub Actions to AWS with OIDC instead of static keys. GCP for the AI side: Cloud Run, Pub/Sub, BigQuery, Vertex AI, VPC peering.
Rolled StepSecurity harden-runner from audit to enforcement across a monorepo and satellite repos, with egress allowlists and proof-of-blockage. Ran an LLM-assisted, engineer-reviewed, second-model-verified code security assessment across two repositories, then restaged it after 100-plus remediation commits with stable finding IDs. Cloudflare WAF and application security review with a read-only API collector.
Five years of pipelines before security. Pipeline SME for a mobile platform with a global user base: Airflow on Cloud Composer, BigQuery, Postgres Cloud SQL, GA4 and CRM ingestion, Dataplex standardization. Earlier: ETL/ELT for large technology and financial services companies and federal agencies, and warehouse work in MSSQL, MySQL, and MariaDB. M&A sensitive-data discovery that took 47,318 candidates down to 214 documented exceptions.
Built an AI alert-triage pipeline on GCP: Panther alerts to a Cloud Run RAG agent to BigQuery to Tines, with Vertex AI Vector Search replacing SQL similarity for a 100x query speedup at a third of the cost. Built a self-hosted agentic assistant (Tauri desktop, multi-agent plans, review gates, multi-provider LLM). Running a research program on model-agnostic harness design with pre-registered predicates across Grok, Claude, Gemma, and Qwen.
Lead architect across six concurrent enterprise engagements. Author of milestone-based fixed-fee SOWs, assessment reports in technical and leadership tiers, and M&A due-diligence deliverables. Manage engineers and contractors, run hiring, own customer architecture calls with CISO-level sponsors. I take the blame and pass on the credit.
Customer names are left out on purpose. Ask me about any of it.
AI and cybersecurity services. Joined as a contractor building the SOCAlpha alert-triage system, went full time in April 2026, and took over engagement architecture and delivery leadership for the engineering pod by June. Enterprise customers in uniform services, higher education, pharmacy benefits, automotive retail, AI platforms, and recruiting.
Placed with a nonprofit mobile platform's data engineering team. Grew from contributor to pipeline SME across BigQuery, Airflow, and Cloud SQL, closing out several multi-year pipeline reworks.
ETL/ELT and data warehousing for IT asset management engagements at large technology and financial services companies and federal agencies. ISO 19770-1 practitioner.
Built fleet inventory reporting from scratch in Python and PowerShell for thousands of remote machines, and cut a three-hour migration to under thirty minutes.
Things I built because the problem was in front of me.
OpenTelemetry collection and Panther SIEM pipeline for Claude Code. Local otelcol-contrib and Jaeger as user-scope services, generated Claude Code settings for rich telemetry, session-oriented gzip JSONL export, stdlib SigV4 upload to S3 with SSE-KMS, Vault-issued credentials, Terraform for the bucket and IAM. macOS and Linux installers. Public release 0.2.0, July 2026.
AI-enriched SOC alert triage on GCP. Replaced BigQuery SQL cosine similarity with Vertex AI Vector Search over 4,081 alert embeddings: 10 to 30 seconds down to 134 ms, roughly $300 a month down to $110, on a private VPC endpoint. Includes a change-control agent that matches CloudTrail alerts to Jira tickets and an IaC repo using GitHub OIDC to AWS.
Agentic Systems Harness. A self-hosted assistant that does work rather than chats: sessions and workstreams, supervisor tool loop, multi-step plans, review gates with resume, artifacts promoted into a work tree, Tauri 2 desktop with a review inbox, and Claude, Grok, or local models behind one interface.
Mathematically Equitable Harnesses. A falsifiable thesis that harness structure can be specified independently of the seated model and measured for transfer, with cost counted in tokens and quadratic context occupancy rather than wall clock. Eleven proof campaigns so far across Grok, Claude, Gemma, and Qwen, each with pre-registered predicates and a strict HOLD / FAIL / inconclusive vocabulary.
Open to conversations about security architecture, telemetry, and agent harness design.