I am a security engineer at the Cybersecurity and Infrastructure Security Agency and sometimes contributor to open source.
Work is inseparable from the human experience. It is the context in which we pour much of our energy and develop dimensions of our character that distinguish us within our communities. Work makes demands on our creativity, rewards our ability to problem solve, and supplies an avenue for us to express our freedom. Understood in this way, work is a forge for our dignity. Yet as we cede more domains…
How do we collectively determine whether or not large language models are dangerous when the public narrative is held captive by the companies that build them? This has a chilling effect on a dialogue that needs to take place about AI governance . The march of progress and the specific direction it takes is presented to us as inevitable. The layperson is meant to standby while those that hoard all…
AI has an image problem. We all know it. Whether you are a true believer, a skeptic, or somewhere in between, just about everyone can agree that AI systems and the companies that build them are not worthy of blind trust. This lack of faith gives way to a rising interest in the governance of AI . It would be prudent for today’s AI startup – or really any company incorporating AI in their business –…
Discovering a vulnerability is a rush. If you have performed any pen testing, red teaming, or bug hunting, you know the feeling. It's exhilarating! When you find a clever way to subvert a system – a hack – your synapses fire as strongly as they would if you had made an original scientific discovery. You could certainly call finding vulnerabilities innovative, which helps explain why vulnerability…
I can't claim to be a detection engineer, but looking at my portfolio I can spot detection as a motif in my highest impact projects. And I have good reason to think about the discipline more rigorously now, so I want to use this space to start laying the groundwork for an approach that can keep pace with the volume and velocity of data moving through a modern corporate environment. Let's start…
Yesterday, testimony was heard on “ The AI Security Landscape: How AI is Reshaping Cybersecurity and Critical Infrastructure Resilience ” by the House Homeland Security Committee Subcommittee on Cybersecurity and Infrastructure Protection. The four expert witnesses each testified to a theme giving shape to risks and opportunities of the security applications for large language models. Sandra…
If you came across this post in search of guidance, I empathize with you. I have found security engineering interviews to be treacherous terrain. And if you are to navigate your way to a job offer, you need a good map. Unfortunately, nobody has made one yet. I don't mean to dismiss past contributions made. If you look hard enough, you can find hard-won insights and lessons learned from your peers…
I recently completed several interviews for security engineering roles. Over a period of three months, I completed recruiting calls, phone screens, and onsites with tech companies large and small. The whole process was incredibly difficult. You may well know that standardized resources do not exist for the busy security engineer. Given how broad the domain is, where does one even start? In the…