Upstream maintainer for Falco driverkit, a CNCF project providing runtime security in cloud environments.Responsible for reviewing community code submissions and guiding the direction for the project which has over 30 million users.

Lead the design and implementation of a new lateral movement detection capability in FireEye's EDR product, allowing FireEye to detect suspicious SSH logins in Linux environments. Deployed to a fleet of 20 million nodes.Added Docker support to FireEye’s Linux EDR solution, allowing FireEye to detect suspicious/malicious containers running in cloud-based deployments. Deployed to a fleet of 20 million nodes.

Technical Editor for Packt release SELinux System Administration (3rd Edition)

Beefing up the kernel component of the Distributed Lock Manager (DLM), a locking system used in clustered environments to provide synchronized locking of cluster resources. So far, I’ve upstreamed support for TCP multihoming/failover. This adds a kernel-level mechanism for automatic system recovery in the face of network-layer failure. Currently working on adding DLM lock request retransmission support.

Authored patches that introduce the PaX/grsecurity hardened usercopy feature to the mainline Linux kernel.Co-authored patches that introduce PaX/grsecurity hardened reference counting to Linux. These patches eliminate not one particular bug, but entire classes of kernel bugs. These features were originally developed by the PaX/grsecurity team; my work here was porting them to the mainline Linux kernel. For more information on the defenses provided by PaX/grsecurity, take a look at the link provided below. The feature I ported to the Linux kernel can be found in the "Bounds checks on kernel copies to/from userland" section.

Worked in a shift-based environment, maintaining the Bank's cybersecurity posture on a continuous, 24x7 basis. Encountered DDOS attacks, 0-day malware infections, OWASP attacks against Bank-owned websites and spearphishing attacks.