My org is responsible for* Production Security but onchain instead of in cloud, e.g. : https://github.com/ethereum-optimism/monitorism, https://docs.optimism.io/stack/security/pause* Release Engineering but for protocols instead of kubernetes, e.g. : https://github.com/ethereum-optimism/superchain-ops, https://gov.optimism.io/t/intro-to-optimisms-security-council/6885* Shift-Left & DevSecOps, e.g. : https://runtimeverification.com/blog/kontrol-integrated-verification-of-the-optimism-pausability-mechanism* IT but for a DAO instead of a company.

Tech Lead for Tencent's Security Platform Department (~300 people), responsible for establishing and overseeing the execution of the department's technical strategy around security operations, cloud native security, zero trust policies, etc.

I'm teaching "CSCI-GA.3033-019: Practical Computer Security" at NYU. http://ckev.in/pcs-web/Here is the course description from the NYU course website: "This course teaches the security mindset and practical security concepts that are essential for software engineers, software developers, quality assurance testers and IT managers. The course discusses various attack techniques and defenses for real world applications and the security activities in the SDLC. Its main topics include: low-level exploits, web application security, malware, threat modeling, security requirements, secure coding practices, security & penetration testing, human factors and usability and legal and ethical issues."

I was the manager for the New York City cohort of Security Hub's engineering team, including both software developers and security engineers.AWS Security Hub gives you a comprehensive view of your high-priority security alerts and compliance status across AWS accounts. See more info at https://aws.amazon.com/security-hub/.

See https://security.googleblog.com/2019/12/protecting-programmatic-access-to-user.html for one of the projects we worked on."Binary Authorization for Borg, or BAB, is an internal deploy-time enforcement check that reduces insider risk by ensuring that production software and configuration deployed at Google is properly reviewed and authorized, especially when that code has the ability to access user data. BAB ensures that code and configuration deployments meet certain standards prior to being deployed. BAB includes both a deploy-time enforcement service to prevent unauthorized jobs from starting, and an audit trail of the code and configuration used in BAB-enabled jobs."

Security and Privacy, Data Protection

Program analysis and symbolic execution for complex data structure and trigger-based mobile malware.

We worked on a startup for market-scale mobile malware static and dynamic analysis system.

Chrome extension security.

Worked on PhoneyC, a low-interaction client honeypot for drive-by download detection.

Worked on drive-by downloads detection and distributed honeynet systems.