Application Security · Toronto

Find the vulnerabilities. Build the program that stops them coming back.

Security engineer focused on vulnerability management and application security. Build the tooling, the dashboards, the triage workflows, and the risk models that turn a pile of scanner output into something teams actually act on. Also find the bugs myself. 120+ on HackerOne and counting.

120+

Validated vulnerabilities

30+

Client engagements

Years in security

Conference talks

What I Do

Build and run vulnerability management programs for enterprise clients. The full pipeline: intake from SAST, DAST, SCA, pentests, and bug bounty. Finding correlation, risk scoring, SLA enforcement, remediation tracking, and reporting that actually reaches different audiences in a way they understand.

Also do the hands on work. Pentesting, security code review, vulnerability research. 120+ validated findings on HackerOne against companies like PayPal, Sony, AT&T, and Airbnb. Most of those are multi step attack chains, not scanner output.

The thing that ties it together is tooling. Write production tools in Python, Go, and Rust that automate the boring parts of vulnerability management so the team can focus on the findings that actually matter. Dashboards for engineering, leadership, and compliance. Triage automation that routes to the right team with the right context.

How I Think About Vulnerability Management

Correlate, do not duplicate

Scanners produce a lot of noise. Pull from every source, deduplicate, enrich with asset context and severity, then prioritize. One finding, one owner, one SLA.

Kill the class, not the bug

Fixing individual vulnerabilities one at a time is a losing game. Find the root cause, work with the dev team to eliminate the entire category. That is how the backlog actually shrinks.

Report for the audience

Engineering needs technical detail and fix guidance. Leadership needs trend lines and risk posture. Compliance needs control mapping. Same data, different view. Build all three.

Where I Have Worked

White Tuque, Offensive Security Specialist

Toronto · Oct 2024 to Present

Built vulnerability management programs from scratch for enterprise clients. Designed finding correlation pipelines, risk scoring models, SLA structures, remediation dashboards, and reporting for technical, executive, and compliance audiences. Also run pentests and code reviews that feed directly into the pipeline. Mentor junior engineers. Set technical direction for security tooling initiatives.

ASEC (team joined White Tuque), Penetration Tester

Toronto · May 2024 to Oct 2024

Found 150+ vulnerabilities across fintech and SaaS clients. Built Python/Bash tooling to correlate findings across scanning tools, cut triage time by 40%. Became the team standard.

HackerOne, Security Researcher

Remote · Feb 2022 to Present

120+ validated vulnerabilities on PayPal, Sony, AT&T, Airbnb, Booking.com. Full PoCs with root cause analysis, business impact, and remediation guidance. Multi step chains, not single bugs.

Projects

Vulnerability Correlation Engine

Python, Go · Internal Tool

Ingests SAST, DAST, SCA, pentest, and bug bounty findings. Deduplicates, enriches, risk scores, and outputs a prioritized queue. REST API with Jira integration.

Vulnerability Dashboard

Python, JavaScript · Internal Tool

SLA compliance, remediation velocity, vulnerability class trends, risk posture. Views for engineering, leadership, and compliance.

API Authentication Checker

Burp Suite Extension · Open Source

Automates auth bypass and privilege escalation testing at scale.

View on GitHub

GraphQL SDL Generator

Python · Open Source

Schema reconstruction from introspection for attack surface mapping.

View on GitHub

Speaking and Community

SecTor 2025

Toronto

Presented security research on offensive techniques against smart buildings and IoT attack surfaces.

DEF CON Vancouver

Microsoft

API attack chains and auth exploitation patterns found in production applications.

DEF CON Toronto (DC416)

Co organizer

Help run Toronto's DEF CON group. Monthly meetups, workshops, and talks.

TASK Toronto

Organizing committee

Toronto's Application Security and Knowledge conference.

Tools and Languages

Languages: Python, Go, Rust, JavaScript, Bash, SQL
Security: Burp Suite Pro, Nuclei, Semgrep, CodeQL, SAST/DAST, SCA
Vuln Mgmt: Finding correlation, risk scoring, SLA models, Jira integration, dashboard development
Compliance: SOC 2, ISO 27001, PCI DSS

Find the vulnerabilities. Build the program that stops them coming back.

Correlate, do not duplicate

Kill the class, not the bug

Report for the audience

Lets talk.