Money-critical cores
Ledgers where a single minor unit is not allowed to drift: double-entry postings, integer amounts, idempotency keys and maker-checker approval. Reconciliation runs as a scheduled job with evidence, not as a manual ritual.
What I can do
I work end to end: the data model and its correctness, the runtime that carries it, and the surface people actually touch. The list below describes what I can own, not which client it was for.
What I can do
Multi-tenant platforms
Modular monoliths with bounded contexts, database-enforced tenant isolation and fail-closed configuration. Outbox, saga, dead-letter handling and leader election keep asynchronous work correct under retry.
Real-time media and data pipelines
Multi-source ingest, composition, encoding and packaging with deterministic timestamps. The media core links into forked libraries in process instead of starting a process per stream.
Identity and authorization
Passkeys, second factors, key rotation and sealed credentials. Machine access and human sessions stay separate, and trust is decided from the socket rather than from a forwarded header.
AI agent systems
Multi-service agent platforms with tool orchestration, durable memory over vector and graph stores, and MCP servers as a first-class interface. Routing layers and encrypted local-first pairing where the runtime stays on your own machine.
Apple platform applications
Native SwiftUI on iOS and macOS: menu bar utilities, permission onboarding, Keychain-backed secrets, speech and audio capture, and distribution that survives review.
Low-level systems and security work
Kernel and network level engineering with eBPF, TUN stacks and raw sockets, plus authorized assessment: threat modeling, reverse engineering and reports that carry reproducible evidence instead of adjectives.
Mobile protection mechanisms
The other side of the same work: RASP-style runtime checks, root and jailbreak detection, hook and tamper detection, integrity and signature verification, and the obfuscation and anti-debugging that make all of it expensive to remove. Client-side checks slow an attacker down rather than stopping one, and they are designed that way.
Mobile reverse engineering
Turning an artifact back into behavior: APK, Dex and Smali on one side, Mach-O on the other. Static analysis to find the check that matters, dynamic instrumentation to confirm it, and a written result another engineer can reproduce from the same evidence.
Mobile malware and fraud analysis
Reading what a sample does rather than what it claims: droppers and loaders, overlay and accessibility abuse, and the fraud flows built on top of them. The output is a detection or a hardening change, not a report that ends in adjectives.
Instrumentation and bypass work
Frida harnesses and scripts that attach to a running app, step past certificate pinning and client-side gates, and let a test observe real behavior on a rooted or jailbroken device instead of guessing from the disassembly.
Browser automation and proven tooling
Headless automation that extracts real structure, rebuilds it deterministically and proves the result with pixel diffing rather than asserting success.
Part of the work sits under confidentiality, so names, scopes and outcomes are left out on purpose. What follows is capability.