Threat modeling a zero-trust deployment pipeline
A continuous deployment pipeline for configuration-as-code and infrastructure-as-code into Kubernetes, designed from its threat model outward so the release process does the security review.
I'm a product security engineer in St. Louis, securing Kubernetes and Azure delivery from threat model to release. Alongside it, I work on machine learning, a document platform nobody asked me to build, and a master's degree at the University of Illinois.
Outside of that: scuba diving, rock climbing, hiking, and making things that aren't software. I like problems where the consequences are real.
Open to consulting and interesting problems
5+ yrs
Shipping mission-critical software
$90M
Contract award my cloud migration demo helped secure
10×
Faster integration test cycle
4×
Fewer engineering hours on porting
How I can help
Everything below is work I do now, not work I did once. If your problem looks like one of these, we should talk.
Threat modeling, zero-trust delivery pipelines, service-mesh networking, and security review built into the release process instead of bolted on at the end. This is my day job.
Platform engineering, Kubernetes operations, cloud-native systems, and the boring-but-critical details of reliability, automation, and production support. If it has to run at scale without surprise failures, this is the work I do daily.
Classifiers and NLP pipelines that ship — data preparation through evaluation through deployment. I care more about the failure modes than the leaderboard.
Build systems, CI pipelines, test harnesses and internal tools. Most teams are one good tool away from moving twice as fast, and nobody has time to build it.
Selected work
Some of it shipped to production on hardware I'll never see again. Some of it is a side project my wife asked for. Both taught me something.
A continuous deployment pipeline for configuration-as-code and infrastructure-as-code into Kubernetes, designed from its threat model outward so the release process does the security review.
Three toolchain applications moved to Kubernetes on Azure, deployed one way with Helm and infrastructure-as-code, and secured with an Istio service mesh.
Kernel, task scheduler and communication protocol written from nothing, in C and Ada, now in production and distributed globally.
Writing
Years after our college capstone, an out-of-the-blue email from European AI researchers wanting to reproduce our sign language paper sent me to Google Scholar, where we've been cited 11 times.
Looking back at my senior capstone project at Missouri State — building a real-time American Sign Language smart home controller with MediaPipe, custom CNNs, and networking — and how it sparked my path in machine learning.
The neural-cost v0.2.0 GPU benchmark moves from CPU roofline analysis to Apple Silicon's MPS GPU backend — measuring PyTorch and JAX across five architectures, four batch sizes, and both eager and compiled execution modes.
Off the clock
Same habits, different problems. Most of what I'm good at at work, I practised somewhere else first.
Underwater
Checklists, gas planning, and a buddy who checks your work. Turns out I like that underwater too.
On the wall
Problems you solve with your hands, where the feedback loop is very short and very honest.
Player two
Research, I tell myself. One of them ended up as a reinforcement learning project.
Tetris RLSketchbook
Things that aren’t software, with nothing to compile and no tests to pass.
Let's connect
Contract work, a full-time role, or a problem you want a second opinion on — I read every message and reply to the ones that aren't a template.
Usually replies within a day or two · St. Louis, Missouri