I’m a Security Engineer at OpenAI. Most of my time is spent securing Azure, AWS, Terraform, DevOps workflows, Windows, and Active Directory.

Prior to my current role, I worked on Active Directory and Security at Microsoft in the Asia Pacific region, where I earned the Microsoft Certified Master (MCM) credential for Active Directory. I later moved to the Windows Kernel Engineering team in Redmond and worked on Windows 8 and 10.

I completed the Offensive Security OSCE (along with the OSEP, OSCP, OSWP, and GXPN) and take every chance I can to do offensive security work. I mention these certifications because, while I love my day job, I’m passionate about exploit development, and both Offensive Security and SANS offer excellent courses and exams in that area. I’m also part of the Synack Red Team, where I get opportunities to look for vulnerabilities in systems on an ad-hoc basis.

This website is a small effort to contribute to the broader security community. I add notes when something comes up that seems interesting or potentially useful to others.

If you work for a charity or non-profit organization and could use security (or infrastructure) advice, please get in touch. I’d be genuinely happy to help where I can.

I sometimes write in a less casual style for the companies I work for.

Some examples:

• Restricting SMB-based Lateral Movement in a Windows Environment
• Microsoft Defender Attack Surface Reduction Recommendations
• Assessing the Effectiveness of a New Security Data Source: Windows Defender Exploit Guard
• Windows Privilege Abuse: Auditing, Detection, and Defense
• Building Software for a Zero Trust World
• Managing and Automating Browser Extensions at Scale