Skip to content

Staff Security Engineer @ Polymarket

Current Focus: Security Operations, Endpoint Defense & Application Security

Jul 2026 – Present · Remote

At Polymarket, the world's largest prediction market, I work within the security team securing the platform end-to-end — from the corporate endpoint fleet and employee security posture to the web application surface and cloud estate. The environment handles hundreds of millions in daily volume, where a single compromise can have immediate financial consequences.

Endpoint Security & Detection

  • Endpoint Security — Cortex XDR: Own the Cortex XDR deployment across the corporate fleet — detection engineering, prevention policy tuning, and real-time response. First line of defense against social engineering, phishing, and credential theft targeting employees.
  • SOC Operations — Cortex XSIAM: Operate on the Cortex XSIAM platform for unified SecOps: case triage, causality-chain analysis, alert and IOC correlation, MITRE ATT&CK mapping, and true-positive / false-positive / benign-positive dispositioning. Response scoped by blast radius and reversibility.
  • Threat Hunting: Proactive hunting with XQL across endpoint, identity, and cloud telemetry, turning hunt results into standing detection content rather than one-off answers.
  • Malware Analysis & Reverse Engineering: Static and dynamic analysis of real-world malware samples targeting the organization — including nation-state campaigns. Extract IOCs, map adversary TTPs, and translate findings into XDR analytics rules (BIOCs/XQL) and XSIAM detection logic that kill threats at execution time rather than after compromise.
  • Detection Engineering & Automation: Building and tuning detection rules and response playbooks, biased toward behavioural logic over static indicators. On top sits an AI-assisted triage layer that digests an open case into a prioritised brief with a recommended disposition — read-only by design, with a human on every action that changes state.
  • Incident Response: Response operations tuned to the current Web3 threat landscape — nation-state actors targeting key material, supply chain compromise of third-party scripts, and social engineering against privileged operators — with playbooks designed to contain threats before they escalate.

Application Security & Infrastructure

  • Application Security: Secure SDLC integration, code review, vulnerability management, and penetration testing across web2 and web3 application surfaces.
  • Frontend & Supply Chain Integrity: Subresource Integrity (SRI), strict Content Security Policy, third-party JavaScript governance, dependency pinning and provenance verification, and CI/CD pipeline integrity controls.
  • Cloud Security: Working across a multi-account AWS Organization federated through IAM Identity Center — cross-account asset attribution, secret scanning, static analysis, and dependency auditing across hundreds of repositories spanning two GitHub organisations.
  • Vendor & Third-Party Risk: Security review gates for every external dependency that touches production.

Supporting Exchange Operations

  • Onchain Monitoring: Supporting transaction monitoring and anomaly detection for the exchange and settlement infrastructure — correlating onchain signals with infrastructure telemetry.
  • Bug Bounty Program: Running the receiving end of the public Cantina bug bounty program — first-pass triage, severity calibration, duplicate detection, and researcher communication.
  • Key Management Support: Contributing to the security posture of operational wallet infrastructure — HSM-backed signing, policy-based approval workflows, and wallet segmentation.

Technical Stack

  • Detection & Response: Cortex XSIAM, Cortex XDR, XQL, MITRE ATT&CK, detection engineering, response playbooks, AI-assisted triage automation.
  • Malware Analysis: Static/dynamic analysis, behavioural sandboxing, YARA, reverse engineering.
  • Application Security: SAST, secret scanning, SRI/CSP tooling, dependency provenance, CI/CD hardening.
  • Cloud & Ops: AWS (multi-account Organizations, IAM Identity Center), K8s, Docker.
  • Languages: Python, TypeScript, Solidity.