Application Security Engineer · DevSecOps · Cloud Security
I build and scale security programs that developers actually adopt — turning vulnerability management, SAST/SCA/DAST, and cloud posture into repeatable systems, and increasingly augmenting them with LLMs. 15+ years in software, the last 5 focused on AppSec and DevSecOps across government, finance, and insurance.
📍 Ottawa, Canada · 🇺🇸 Open to U.S. relocation · 🌐 EN / FR / PT
- Application Security — Secure SDLC, secure code review, OWASP Top 10, SAST / SCA / DAST tuning and triage
- DevSecOps — CI/CD security controls, GitHub Actions, GitHub Advanced Security, pipeline integration
- Cloud Security — Azure & AWS posture, CSPM, container/Kubernetes security
- AI for Security — LLM-assisted vulnerability triage, code-review augmentation, security tooling
A few things I've shipped at work: replaced Nexpose with Qualys VMDR and grew asset coverage ~3,000 → 20,000+; migrated SAST from Veracode to Coverity/Polaris, cutting standard scan time from 4 hours to 20 minutes; built an internal ASPM platform and an executive Power BI security dashboard; and introduced LLM-assisted triage into the security program.
appsec-lens-aws — AppSec intelligence platform
Aggregates findings from CNAPP, GHAS, Polaris, and Sonatype IQ into a normalized model you can query, with summaries grounded in real records (no autonomous actions). The ASPM pattern, built for AWS.
Python·FastAPI·PostgreSQL·MongoDB·AWS (ECS/RDS)
appsec-contextual-triage — Privacy-first AppSec triage (PoC)
Two-phase CI/CD triage gate: a deterministic check decides whether a flagged vulnerable sink is actually used, then a local LLM (Ollama) adds an explainable audit note — failing closed if the model is unavailable, so the AI never becomes the security control. Built for regulated environments where source code must stay local.
Python·Ollama / local LLM·GitHub Actions·fail-secure design
security-gate — Reusable DevSecOps security gate
Drop-in GitHub Actions workflows for SAST, SCA, SBOM, and secret scanning, with a results dashboard and multi-team rollout docs. Security teams actually adopt it.
GitHub Actions·SAST / SCA / SBOM·CI/CD·JavaScript dashboard
Python · Azure · AWS · GitHub Actions · Qualys VMDR · Coverity / Black Duck · Docker · Kubernetes · Power BI
SC-900 (Microsoft Security, Compliance & Identity) · AWS Certified Cloud Practitioner · Generative AI Certificate — in progress (uOttawa)