I'm a security leader and hands-on builder. For the past four years I've led security teams through servant leadership — removing blockers, supporting people, and helping teams do their best work — while continuing to ship security tools and vulnerability research myself.
I'm looking for a security leadership role where I can support a team, develop its people, and improve how it protects the organisation.
- Agentic security tooling — AI-assisted analysis and review that stays inside narrow, verifiable boundaries
- Vulnerability research — end-to-end CVE reproduction labs with retained, gate-checked evidence
- Detection and defense — honeypots, exposure checkers, and supply-chain tooling
| Project | What it does | Language | ★ |
|---|---|---|---|
| turenos | Local-first AI security agent harness; works with most models and providers | TypeScript | 8 |
| batou | Catches risky code while Claude Code writes it, before it lands | Go | 5 |
| secpapers | Living catalog of LLM security research, updated daily from arXiv | Python | 3 |
| omc | Drop-in npm/pip that never runs install scripts; deny-by-default supply-chain security | Rust | 2 |
| homebrew-turenos | Homebrew tap for TurenOS | Ruby | 2 |
| lisa | GitHub Action auditing PRs for secrets, vulnerabilities, and unneeded complexity | Python | 1 |
| spice | OSS exposure checker for developers | Go | 1 |
| jast | Experimental SAST desktop app built on TypeSafe AI's Jev | Rust | 1 |
| harness | Run multiple Claude Code sessions side by side | TypeScript | 1 |
| polyapi-prototype | Typed polyglot API compiler and UDS runtime | Go | — |
| spice-detections | Detection packs for spice | — | — |
| Project | What it does | Language | ★ |
|---|---|---|---|
| helix-honeypot | Kubernetes API honeypot with active-defense capabilities | Go | 44 |
| haproxy-quic-cves-2026 | Digest-pinned reproduction lab + network PoCs for HAProxy QUIC CVEs | Python | — |
| bind-cves-2026 | Isolated Docker reproduction labs for four BIND 2026 CVEs | Python | — |
| cyberorgsim | PARC-based cybersecurity organisation simulator (Tauri desktop app) | JavaScript | — |
| quill | Adversarial-prompt fuzzer for LLMs — mutated prompts + anomaly detection | Python | — |
| crowdsec-firewalla | CrowdSec engine + iptables bouncer for Firewalla Gold | Shell | 1 |
| tech-news-review | Agent skill for verified AI/security news briefings with CISA KEV cross-checks | — | — |
I write about security engineering, AI agents, and the decisions behind the tools I build — blog.turen.io