Skip to content

Career & Security Expertise

Staff Security Engineer @ Polymarket

Current Focus: Security Operations, Endpoint Defense & Application Security

At Polymarket, the world's largest prediction market, I work within the security team securing the platform end-to-end — from the corporate endpoint fleet and employee security posture to the web application surface and cloud estate. The environment handles hundreds of millions in daily volume, where a single compromise can have immediate financial consequences.

  • Endpoint Security — Cortex XDR: Own the XDR deployment across the corporate fleet — detection engineering, prevention policy tuning, and real-time response. First line of defense against social engineering, phishing, and credential theft targeting employees.
  • SOC Operations — Cortex XSIAM: Unified SecOps platform for case triage, causality-chain analysis, alert correlation, MITRE ATT&CK mapping, and dispositioning. Proactive threat hunting in XQL across endpoint, identity and cloud telemetry.
  • Malware Analysis & Reverse Engineering: Static and dynamic analysis of real-world samples — including nation-state campaigns. Extract IOCs, map adversary TTPs, and translate findings into XDR analytics rules (BIOCs/XQL) and XSIAM detection logic that kill threats at execution time.
  • Detection Engineering & Automation: Behavioural detection rules and response playbooks. AI-assisted triage layer that digests cases into prioritised briefs — read-only by design, with a human on every action that changes state.
  • Application Security: Secure SDLC, code review, vulnerability management, and penetration testing across web2 and web3 surfaces. Supply chain hardening: SRI, CSP, dependency pinning, provenance verification, and CI/CD integrity controls.
  • Cloud Security at Scale: Multi-account AWS Organization with IAM Identity Center — cross-account asset attribution, secret scanning, static analysis, and dependency auditing across hundreds of repositories.
  • Incident Response & Vendor Risk: Response operations tuned to the Web3 threat landscape, and security review gates for every external dependency that touches production.
  • Exchange Support: Onchain monitoring, bug bounty triage (Cantina), and contributing to operational wallet security posture (HSM-backed signing, policy controls).
  • Certifications: CW3H (Certified Web3 Hacker) and Certified Smart Contract Auditor.

Professional Journey

With over 18 years in software development (since 2008) and 13 years dedicated to the Secure Software Development Lifecycle (SSDL) (since 2013), I have built a career at the intersection of engineering and elite-level security.

Web3 Protocol Security & Defensive Operations

  • Aave Labs — Senior Cyber Security Engineer (Dec 2024 – Jul 2026): Owned the full security perimeter of a leading DeFi protocol — smart contract invariant monitoring (Tenderly, across V3 solvency guarantees and V4's Hub-Spoke architecture), behavioural anomaly detection (Hypernative), and a Sumo Logic SIEM correlating on-chain and infrastructure signals to distinguish real exploit activity from false positives. Bridged offensive tradecraft — deep-dive audits and penetration tests on web3 apps and smart contracts — with high-fidelity defensive operations.

Offensive Security & Threat Simulation

  • AttackIQ — Software Engineer, then Security Engineer (Mar 2020 – Dec 2024): Focused on offensive security and Breach & Attack Simulation (BAS). I specialized in automating threat actor scenarios under the MITRE ATT&CK framework, providing customers with actionable intelligence on their security control effectiveness, mastering controls like Splunk and Crowdstrike.

Security Engineering & Operations

  • Qustodio — Senior Software Engineer & DevOps (Oct 2016 – Mar 2020): Transitioned to a Blue Team operations role, where I spearheaded security architecture and engineering projects.
  • Telefónica R+D — Senior Software Engineer (Sep 2013 – Sep 2016): Focused on SSDL and secure web engineering, laying the foundation for my expertise in secure coding and systems design.

Early Career — Software Engineering

  • Carritus — Senior Developer (2013): Full-stack engineering, database design, and data mining for business intelligence.
  • eyeOS — Junior Developer (Apr 2011 – Apr 2013): Web virtualization research and the platform's migration from a PHP monolith to NodeJS microservices.
  • Freelance — Web Developer (May 2009 – Feb 2011): Custom web solutions and CMS implementations for local clients.
  • Futurway — Web Developer (Jun 2008 – Jan 2009): Web infrastructure for GPS tracking systems, with IoT firmware support.

Core Security Pillars

1. Security Operations & Detection Engineering

  • SOC Platforms: Cortex XSIAM and Cortex XDR (case triage, causality analysis, XQL hunting); previously Sumo Logic (SIEM) and CrowdStrike (EDR), including Custom IOAs.
  • Endpoint Security: EDR deployment, prevention policy tuning, detection engineering, and real-time response against social engineering, phishing, and credential theft.
  • Detection Content: Behavioural detection logic and MITRE ATT&CK-mapped response playbooks, favouring durable behaviour over static indicators.
  • Malware Analysis: Static and dynamic analysis, reverse engineering, YARA — translating adversary tradecraft into deployed detections.
  • Triage Automation: AI-assisted case triage and bug bounty triage pipelines — machine-generated briefs and recommendations, human-executed actions.
  • Threat Intelligence: Tracking nation-state and financially motivated actors targeting crypto infrastructure, and converting that intel into deployed detections.

2. Application Security & Infrastructure Hardening

  • AppSec: Secure SDLC, code review, vulnerability management, penetration testing. Supply chain hardening: SRI, CSP, dependency pinning, provenance verification, CI/CD integrity.
  • Cloud & Infrastructure: Expert-level knowledge of AWS, with deep experience in Azure, GCP, and OpenStack. Secure network, compute, and storage architectures.
  • Container Security: Orchestrating secure environments using Docker and Kubernetes.
  • Protocols: Low-level mastery of TCP/IP, TLS, HTTP/S, and specialized protocols like SPICE.

3. Web3 Security

  • Languages: Proficient in Solidity and EVM opcodes, Python, and NodeJS.
  • Onchain Monitoring: Transaction monitoring, anomaly detection, smart contract observability.
  • Cryptography: Deep understanding of DLP, Factorization, and primitives (SHA, AES, RSA, ECC). Currently preparing for new Post-Quantum Cryptography (ML-KEM/Lattice-based).

4. Engineering & Research

  • Low-Level & Performance: Development in Assembly x86-64, C, Rust, and Go.
  • AI/Agentic: Designing secure architectures for AI agents that touch wallets and secrets — hardware-backed key custody, policy and quorum controls, and human-in-the-loop approval for anything that moves value.
  • Data Analysis: Leveraging Python (Pandas, TensorFlow, Jupyter) for security data science and alerting automation.