Two roles so far and neither one has "security" in the title. One of them has me handling student PII under FERPA, which is where I found out that most of protecting data is boring process, not tooling. The other was my own company, where I had to stand up the auth myself and then go find what I'd gotten wrong.

Longer thinking, not evidence. The case files under Projects are the graded writeups: ref, severity, root cause, patch. These are the posts where I work out what a whole class of bug actually is, or what a project changed about how I look at things. If it could be assigned a severity it belongs in Projects, and if it starts with "I" and could not be graded, it goes here.

Six industry certifications, listed with the issued year. Every one is verifiable: Credly holds the issuer-signed badges and LinkedIn carries the same list. Additional certificates are grouped separately, since a certificate and a certification are not the same thing.

I'm a cybersecurity student at Coastline College, and most of what I know started with breaking things I already owned. I ran modded Minecraft and CS:GO servers for years before it clicked that a game server is just an attack surface with players sitting on it. That's the thread through everything here. I decompiled 400+ mods, found authorization gaps in 50+ of them, and reported every single one before I wrote a word about it on this site. I'm still early in this. I'd rather show you the work than a list of adjectives.

Everything accomplished above was done within my own systems without compromising any external devices, participating in illegal activities, or with malicious intent. All findings get reported to the developer or maintainer first, and any further testing I do afterwards stays private and is only for documentation. It all stays redacted until a patch is deployed for the vulnerability, or until the developer or maintainer gives me permission to publish.