About Me

My Path to Security

I've thought like a security engineer since before I knew the term existed. As a kid, I noticed how social systems worked. How trust was given and exploited, how people got deceived, and I found myself analysing the mechanisms rather than just the outcomes. That same pattern carried into my technical career: when I look at a system, I naturally see how it could fail, how it could be abused, where the assumptions might be wrong.

My path through infrastructure, from branch banking systems support during national service at GCB, to healthcare data at Lightwave, to AWS and Kubernetes at Prymo, kept pulling me toward security because that's where the stakes are real. I do my best work when failure actually matters. I'm not chasing the title; I'm drawn to building systems that are elegant, correct, and resilient. Security is where that craftsmanship matters most.

Why Payments Infrastructure

Security arguments can stay abstract for a long time. Payments don't allow that. When the platform slows down, transactions fail. When a control is weak, what's exposed is money and regulated data, not a hypothetical. The feedback is immediate and it's measured, which is exactly the environment I work best in.

That constraint shapes how I build. I'd rather remove a class of attack than watch for it, which is why replacing every long-lived cloud credential with OIDC federation mattered more to me than any dashboard. I'd rather security ran inside the pipelines engineers already use than sat beside them as a gate they resent. And I'd rather prove all of it through an audit than assert it.

What I Believe

Problems I Want to Solve

• Attack classes, not incidents: Changes that make a whole category of attack impossible rather than merely detectable. Removing long-lived credentials entirely was one. There are others worth finding.
• Supply chain integrity: Knowing what actually reaches production, and making the pipeline the place where that gets decided.
• Detection that earns its alerts: Rule-based monitoring misses what nobody thought to write a rule for. My dissertation applied an Isolation Forest model to Graylog log data to see how much of that gap machine learning could close.
• Securing AI systems and training pipelines: The direction I'm pointing my career next, building on applying machine learning to security detection rather than claiming it as ground I've already covered.

Practical engineering problems, not theoretical research.

Education