Security Consultant with AppSec & SecOps Expertise
I don't just find vulnerabilities; I help organizations build resilience.
10+ years in security - built a bank's SOC from scratch, now simulating adversaries to protect Australia's most critical enterprises at Sekuro. CVE author. Full-spectrum perspective.
Web, Mobile, and API security assessments. Finding vulnerabilities in application logic, authentication, and data handling across platforms.
Creating proof-of-concept exploits for discovered vulnerabilities. Automating exploitation to demonstrate real-world impact.
Responsible disclosure of vulnerabilities in commercial software. Multiple CVE discoveries in enterprise applications.
Deploying and managing security tools: Nessus, Rapid7 InsightVM/IDR/AppSec, CyberArk PAM, Darktrace NTA, Microsoft Sentinel & XDR, UTMStack SIEM.
SAST with SonarQube, Checkmarx, Semgrep. Manual code review augmented with LLM agents for comprehensive coverage.
Providing end-to-end security services to clients across industries. Risk assessments, compliance guidance, and security architecture.
CVE-2026-80138CriticalOS Command Injection via Installer php_cli_filepath Parameter
View on CVE.orgCVE-2026-77914CriticalArbitrary File Read via Export Download Endpoint
View on CVE.orgCVE-2026-77915CriticalUnauthenticated Admin Account Creation via Duplicate Auth Routes
View on CVE.orgHow I discovered a critical unauthenticated remote code execution vulnerability in ClipBucket V5 web installer that allows complete server compromise with a single HTTP request.
A CVSS 10.0 vulnerability allowing complete unauthenticated takeover of rConfig instances through a misconfigured registration route.
How I discovered a critical path traversal vulnerability in rConfig Core that allows any authenticated user to read arbitrary files, including the application secrets.
Available for conference talks, workshops, and security community events. Topics include vulnerability research, red teaming, and building security programs.