Security Engineer — AI Security & Application Security
Berlin, Germany · Open to security engineering roles (EU)

I build and break the security layer around LLM applications. Most of my time goes to prompt-injection defence, API and application security testing, and turning findings into tooling that survives contact with production traffic.

Currently an independent security researcher (private bug bounty and coordinated disclosure), finishing an MSc in Artificial Intelligence in Berlin, after an MSc in Cyber Security and security roles since 2020 spanning penetration testing, application security, and vulnerability research.

Two-tier prompt-injection detection for production LLM serving. Sub-millisecond on the common path, evaluated against four external benchmarks.

→ Guardrail-As-A-Service-V2 · Python · Docker · ONNX · Prometheus

The headline result is not the 1.000. It is the 21-point gap between the in-sample score and the held-out one. Tier 1's blocklist was tuned by inspecting the attacks it missed on that corpus, so the perfect score is partly memorisation — the repo says so, quantifies it, and ships the split script that proves it.

Design decisions I can defend in an interview:

• Tier 1 — Aho-Corasick + regex over normalised text, scanned twice: once preserving structural markers (<|im_start|>, safety_mode=off), once de-obfuscated to catch 1gn0r3 prev10us 1nstruct10ns. p50 0.14 ms.
• Tier 2 is monitor-only, deliberately. DeBERTa-v3 ONNX scores and logs but does not block, because on NotInject it rejects 40.4% of benign prompts against Tier 1's 0.0%, and the over-defense is not threshold-separable. The cost is a recall ceiling. Both operating points are published.
• Fail-open. If the Tier 2 model errors, the request is allowed. Availability over semantic coverage, stated rather than defaulted into.
• A content-safety baseline (Llama-Guard-3-8B) misses 165/190 attacks here — reported as "content-safety guardrails don't transfer to prompt injection", not as a 7× win.

Private bug bounty and coordinated disclosure. Statuses are reported as they resolved — duplicates and informatives included.

🥇 #1 Quarterly Leaderboard (RO07 Ch13f) and Top 10 Quarterly (Bug Baron) on Intigriti.

Tooling: Burp Suite Pro · Semgrep · libFuzzer / CI Fuzz · custom Python recon and validation harnesses.

AI / LLM security — prompt injection · RAG security · OWASP LLM Top 10 · NIST AI RMF · garak · ONNX Runtime · PyTorch · Transformers · SHAP

Offensive — Burp Suite Pro · Nmap · Nessus · Semgrep · libFuzzer / CI Fuzz · threat modelling (STRIDE)

Detection & response — Microsoft Sentinel · Defender for Endpoint · Splunk · Prometheus · Grafana

Cloud & platform — AWS · Azure · OCI · Terraform · Docker · GitHub Actions

Languages — Python · Bash · PowerShell · SQL

Long-form technical write-ups on Medium — bug bounty methodology, CTF chains, and the reasoning behind findings, including the ones that came back as duplicates.

_{English (professional) · German (A2, improving) · Spanish (elementary)}