Leading Windows agent and EDR platform work across kernel and user mode, with a focus on exploit-aware telemetry, defensive hardening, and practical platform modernization.

• Architected enterprise EDR capabilities across kernel and user mode
• Established AI-assisted workflows and engineering standards across a large legacy codebase
• Built crash-dump and behavioral-analysis utilities for production defense

Developed advanced CNO tooling and led research into evasion, anti-analysis, and validation infrastructure across multiple operating systems.

• Built implants, loaders, and supporting command-and-control infrastructure
• Researched hypervisor-based and hardware-assisted evasion techniques
• Introduced automated testing and CI patterns inside constrained environments

Worked across red- and blue-team assessments, supply-chain research, vulnerability analysis, and technical reporting for senior stakeholders.

• Contributed to work referenced in senior-level cyber policy discussions
• Researched SolarWinds-class attack paths and defensive replication strategies
• Performed reverse engineering, application security audits, and tool evaluation