Principal Software Architect at Stripe. I build the systems, frameworks, and
people that turn adversary tradecraft into a defender's instrument — from Tier-3
incident response at Amazon to attacker engineering at scale.
LAT 37.4848°NLON 122.1484°WUPTIME · 19ySECTOR · FINTECH / SECURITY● TX
// impact
// resume of impact
// trajectory · 2007 → presenthover any node for detail
2007·INTEL
U.S. Federal · Intel Community
Signals & Pattern-of-Life Analyst
Two years anchored in the intel side of the house. Pattern-of-life, signals work, attribution. Learned to think about adversaries as systems before learning to defend against them.
FOUNDATION
2012·RESEARCH
Industry Research · Adversary Emulation
Threat Researcher
Bridged intel into engineering. Built early adversary-emulation tooling and joined the closed-circle red/blue communities that still anchor the work today.
BRIDGE
2017·AMAZON · TIER-3
Amazon
Senior Security Engineer · Tier-3 IR
Top-tier responder for the highest-severity events across AWS and retail. Built the tooling the responders who came after now rely on. The hardest, fastest, most consequential five years of the career.
400+ ENGAGEMENTS
2022·STRIPE · ATTACKER ENG
Stripe
Principal Software Architect · Head of Attacker Engineering
Founded and scaled the Attacker Engineering practice. Offensive-informed architecture across payments, identity, and platform surfaces. The seat where intel, IR, and engineering finally close the loop.
MULTI-YEAR PROGRAM
2024·FT3 · OSS
Friendly Threat Triage (FT3)
Creator · Maintainer
Open-sourced the framework that turns adversary tradecraft into repeatable defender hypotheses. Hundreds of emulation cells, deterministic replays, machine-readable coverage. Adopted across vendors, federal, and operator-led teams.
v0.9 SHIPPED
2026·PENDING · SSL
Stripe Security Labs
Pending — public launch
The next chapter. A research arm with the operator floor in mind: open frameworks, deep collaborations, the long game.
Q3 2026
2022 — Now
Stripe
Principal Software Architect · Head of Attacker Engineering
Founded and scaled the Attacker Engineering practice. Drives offensive-informed architecture across Stripe's payments, identity, and platform surfaces.
Top-tier responder for the highest-severity events across AWS and retail. Tool-builder for the responders who came after.
Incident Response Forensics Threat Hunting
tier
TIER-3
Earlier
Industry · Federal · Research
Threat Intelligence · Adversary Emulation
A career arc moving from intel-side analysis to engineering, anchored in elite intel communities and red/blue collaboration.
Intel Emulation Community
tier
FOUNDATION
// ft3
// project spotlight · ft3
An open framework for friendly threat tradecraft.
FT3 is the operational backbone of Stripe's attacker engineering work —
open-sourced so defenders everywhere can plan, stage, execute, and triage
adversary emulation against the systems they're paid to protect.
// receipts — ft3 precedence trail
four tracks · nine dates · one record
The receipts.
Precedence is a fact of the record, not a claim in a deck. The dates run from the
first internal authoring of FT3 to the agentic ship. Every node below is
verifiable in the public record.
view as
FT3 / DARKSHEER
FS-ISAC
RH-ISAC + TARGET
MITRE CTID
Feb 2024
FT3 authored
Internal at Stripe — first cut of the framework.
Oct 2024
Submitted to FS-ISAC
FT3 talk proposal sent to the 2025 Spring Summit CFP.
28 Jul 2025
FT3 published
Open-sourced publicly on GitHub.
Apr 2026
FT3 ships agentic
★ FIRST LIVING AGENTIC FRAMEWORK
Stripe launches FT3 with agentic capabilities — first 'living' agentic framework.
Oct 2024
DECLINED
FS-ISAC declines the FT3 proposal. The receipt that lights the rest of the trail.
1 Apr 2025
CFPF launched
FS-ISAC launches the Cyber Fraud Prevention Framework.
3 Aug 2025
Fraud Taxonomy
NRF + RH-ISAC + Target publish a 'Fraud Taxonomy.'
12 Nov 2025
F3 published
MITRE CTID publishes F3 — Fight Fraud Framework — based on CFPF.
8 Apr 2026
F3 STIX 2.1 bundle
MITRE CTID releases the STIX 2.1 bundle for F3.
Presentation Declined
Feb '24
May '24
Aug '24
Nov '24
Feb '25
May '25
Aug '25
Nov '25
Feb '26
FT3 authored Feb 2024. Proposal submitted Oct 2024. CFPF launched Apr 2025. FT3 public Jul 2025. Fraud Taxonomy created Aug 2025. F3 public Nov 2025. Precedence is a fact of the record, not a claim in a deck.
Cohort-based 4-week program for senior security engineers transitioning into adversary-emulation roles.
PRIVATE · ENTERPRISE
/collab
COLLAB
Closed-circle Threat Intel
Long-standing collaborator across vetted intel communities — vendor, federal, and operator-led.
MEMBER · MULTIPLE
/advisory
ADVISORY
Detection R&D Advisory
Selective advisory for security platforms whose detection content I respect.
BY REFERRAL
/mentor
MENTOR
Engineer-to-Operator Mentorship
Mentor for engineers crossing the bridge into hands-on offensive and IR work.
ONGOING
// about
// about
A career spent at the seam between engineering and intel.
Two decades on the wire. The arc starts in intel — pattern-of-life, signals,
attribution — and bends through research, top-tier incident response, and the
operator floor before landing in the architecture seat.
Today the work is about building the systems and the people who turn adversary
tradecraft into a defender's instrument. Open frameworks, deep collaborations,
and the long game.
Currently ·
Menlo Park · Stripe · pending Stripe Security Labs.
// contact
// contact
Speaking, advisory, and select consulting.
Inquiries are read personally. Lead with context — what you're protecting, who
you think is in scope, and the deadline you're working against.