Skip to content

Career & Security Expertise

Staff Security Engineer @ Polymarket

Current Focus: Exchange Security Architecture, Security Operations & Supply Chain Integrity

At Polymarket, the world's largest prediction market, I work within the security team defending a hybrid on-chain/off-chain exchange where markets settle real-world outcomes with real money at stake. I also support the US-regulated venue operating under the same roof. The attack surface spans the full spectrum: non-custodial smart contract infrastructure on Polygon (CTF Exchange), operational key material, a high-traffic web frontend, a multi-account cloud estate, and the vendor ecosystem behind all of it. My focus is helping make every layer of it hostile territory for an attacker, from the signing ceremony to the browser.

  • SOC Operations — Cortex XSIAM & XDR: Case triage end to end on Cortex XSIAM — causality-chain analysis, alert and IOC correlation, MITRE ATT&CK mapping, and true-positive / false-positive / benign-positive dispositioning — with response scoped by blast radius and reversibility. Proactive threat hunting in XQL across endpoint, identity and cloud telemetry.
  • Detection Engineering & Response Automation: Building and tuning detection content and response playbooks, biased toward behavioural logic over static indicators. On top sits an AI-assisted triage layer that digests an open case into a prioritised brief with recommended disposition and fix-owner routing — read-only by design, with a human on every action that changes state.
  • Cryptographic Key Management: Architecting HSM-backed signing infrastructure for operational wallets — hardware-enforced key custody, policy-based transaction approval, wallet segmentation by blast radius, and quorum controls so no single compromised credential can move funds.
  • Frontend & Supply Chain Integrity: Hardening the web delivery pipeline against client-side attacks — Subresource Integrity, strict Content Security Policy, third-party JavaScript governance, dependency pinning with provenance verification, and CI/CD integrity controls.
  • On-Chain Threat Detection: Building monitoring for the CTF Exchange architecture — order settlement correctness, atomic swap invariants between outcome tokens and collateral, operator key behaviour, and oracle-resolution integrity for market settlement — correlating on-chain signals with infrastructure telemetry to separate real exploit activity from noise.
  • Regulated Venue Security: Supporting the security of a US-regulated derivatives exchange stack — clearing, matching, FIX/ISV connectivity and regulatory reporting — where control expectations and the evidentiary bar differ materially from crypto-native infrastructure.
  • Cloud & Application Security at Scale: Security sweeps across an estate of hundreds of repositories spanning two GitHub organisations (secret scanning, static analysis, dependency and provenance auditing), and cross-account asset attribution across a multi-account AWS Organization federated through IAM Identity Center.
  • Bug Bounty Program Operations: Running the receiving end of the public Cantina bug bounty program — first-pass triage, severity calibration and dispute handling, duplicate detection, routing by ownership across application and protocol teams, and researcher communication.
  • Nation-State Threat Research: Reverse engineering malware campaigns from actors targeting the crypto space, prioritising behavioural analysis over short-lived static indicators, and translating that tradecraft into durable detection logic that breaks the threat chain at execution time.
  • Incident Response & Vendor Risk: Response operations tuned to the current Web3 threat landscape, and security review gates for every external dependency that touches production — because in Web3 your perimeter includes everyone you trust.
  • Certifications: I hold the CW3H (Certified Web3 Hacker) and Certified Smart Contract Auditor designations.

Professional Journey

With over 18 years in software development (since 2008) and 13 years dedicated to the Secure Software Development Lifecycle (SSDL) (since 2013), I have built a career at the intersection of engineering and elite-level security.

Web3 Protocol Security & Defensive Operations

  • Aave Labs — Senior Cyber Security Engineer (Dec 2024 – Jul 2026): Owned the full security perimeter of a leading DeFi protocol — smart contract invariant monitoring (Tenderly, across V3 solvency guarantees and V4's Hub-Spoke architecture), behavioural anomaly detection (Hypernative), and a Sumo Logic SIEM correlating on-chain and infrastructure signals to distinguish real exploit activity from false positives. Bridged offensive tradecraft — deep-dive audits and penetration tests on web3 apps and smart contracts — with high-fidelity defensive operations.

Offensive Security & Threat Simulation

  • AttackIQ — Software Engineer, then Security Engineer (Mar 2020 – Dec 2024): Focused on offensive security and Breach & Attack Simulation (BAS). I specialized in automating threat actor scenarios under the MITRE ATT&CK framework, providing customers with actionable intelligence on their security control effectiveness, mastering controls like Splunk and Crowdstrike.

Security Engineering & Operations

  • Qustodio — Senior Software Engineer & DevOps (Oct 2016 – Mar 2020): Transitioned to a Blue Team operations role, where I spearheaded security architecture and engineering projects.
  • Telefónica R+D — Senior Software Engineer (Sep 2013 – Sep 2016): Focused on SSDL and secure web engineering, laying the foundation for my expertise in secure coding and systems design.

Early Career — Software Engineering

  • Carritus — Senior Developer (2013): Full-stack engineering, database design, and data mining for business intelligence.
  • eyeOS — Junior Developer (Apr 2011 – Apr 2013): Web virtualization research and the platform's migration from a PHP monolith to NodeJS microservices.
  • Freelance — Web Developer (May 2009 – Feb 2011): Custom web solutions and CMS implementations for local clients.
  • Futurway — Web Developer (Jun 2008 – Jan 2009): Web infrastructure for GPS tracking systems, with IoT firmware support.

Core Security Pillars

1. Security Architecture & Hardening

  • Cloud & Infrastructure: Expert-level knowledge of AWS, with deep experience in Azure, GCP, and OpenStack. I design secure network, compute, and storage architectures.
  • Container Security: Orchestrating secure environments using Docker and Kubernetes.
  • Distributed Systems: Applying patterns like Saga, CQRS, and Sharding within a security-first framework.
  • Protocols: Low-level mastery of TCP/IP, TLS, HTTP/S, and specialized protocols like SPICE.

2. Web3 & Smart Contract Security

  • Languages: Expert in Solidity and EVM opcodes, Python, and NodeJS.
  • Auditing: Comprehensive smart contract exploit development and auditing (EVM).
  • Cryptography: Deep understanding of DLP, Factorization, and primitives (SHA, AES, RSA, ECC). Currently preparing for new Post-Quantum Cryptography (ML-KEM/Lattice-based).

4. Security Operations & Detection Engineering

  • SOC Platforms: Cortex XSIAM and Cortex XDR (case triage, causality analysis, XQL hunting); previously Sumo Logic (SIEM) and CrowdStrike (EDR), including Custom IOAs.
  • Detection Content: Behavioural detection logic and MITRE ATT&CK-mapped response playbooks, favouring durable behaviour over static indicators.
  • Triage Automation: AI-assisted case triage and bug bounty triage pipelines — machine-generated briefs and recommendations, human-executed actions.
  • Threat Intelligence: Tracking nation-state and financially motivated actors targeting crypto infrastructure, and converting that intel into deployed detections.

3. Engineering & Research

  • Low-Level & Performance: Development in Assembly x86-64, C, Rust, and Go.
  • AI/Agentic: Designing secure architectures for AI agents that touch wallets and secrets — hardware-backed key custody, policy and quorum controls, and human-in-the-loop approval for anything that moves value, so a compromised agent cannot sign on its own.
  • Data Analysis: Leveraging Python (Pandas, TensorFlow, Jupyter) for security data science and alerting automation.