First security engineer at Gusto. Responsibilities include:• Conducting threat models with all teams• Performing code reviews to find potential vulnerabilities• Providing security education• Operating our bug bounty program• Building security tools and services for engineers

Synack is a platform that integrates Hydra with the world’s best security researchers (Synack Red Team) to discover exploitable vulnerabilities across websites, mobile applications, and host-based infrastructure of Fortune 500 companies. Hydra is a scalable, distributed system which combines a modern vulnerability scanner and hacker toolkits to provides actionable intelligence for the Synack Red Team.• Designed methodology and built plugins to automate and mimic traditional penetration testing across hundreds of customers with passive reconnaissance, active footprinting, and vulnerability testing by using open-source software (e.g. Masscan, Nmap, OpenVAS, ssh-audit, sslyze, Wfuzz, WhatWeb, etc.) and custom-built tools• Developed Go-based multi-threaded subdomain bruteforcing tool with custom resolvers and DNS resolution• Reviewed and verified vulnerability reports from security researchers to incorporate new payloads for improving vulnerability scanner’s dectection of XSS and SQL injection attacks• Implemented scalable, backend APIs in Python to surface actionable intelligence from vulnerability scanner stored in MongoDB to web platform for security researchers• Developed external service with Go and DynamoDB for sales organization to scope and price potential clients’ web and host assets by using aforementioned plugins

• Modified Dionaea, a malware capturing honeypot, to run on Raspberry Pi; received coverage from The Register• Architected and developed complete integration testing for client application with Jenkins• Created training data for supervised machine learning algorithm to detect malicious IP addresses

• Created and implemented algorithms to detect usage time of paths from network traffic of worldwide monitors and network route leaks caused by a misconfiguration or attack• Published research in “IEEE International Conference on Communications”

• Embedded malicious JavaScript code in PDFs to evade browser’s mechanisms for detecting malware• Collected and analyzed malware samples for emulation based obfuscation of JavaScript