A few things worth describing.

Five years as an engineer on a care-management platform used by clinical staff. Backend work across Elixir and Ruby on Rails: integrations with systems that were never meant to be integrated with, authorization models that have to hold up under audit, and the slow, deliberate work of making a maturing codebase safe to change.

I'm the primary engineering resource on our push toward a top-tier healthcare security certification — translating control requirements into actual engineering work, and treating the deadline as leverage rather than paperwork.

Security is not my title. It is what the team brings me anyway, and has been for most of the five years.

A self-hosted tool for security and compliance teams drowning in vendor security questionnaires. It keeps a searchable vault of approved answers and matches incoming questions against it semantically, so the twentieth SOC 2 questionnaire costs a fraction of the first.

Search runs on sentence embeddings generated locally with Bumblebee and Nx, stored in pgvector — no inference API, no data leaving the host. Phoenix LiveView for the answering workflow, keyboard-driven, with trigram search retained as a fallback.

A containerized scanner that pulls a Rails repository, runs Brakeman and bundler-audit against it, and normalizes the findings — wrapped in a Rails application that tracks results over time so you can see whether a codebase is actually getting safer.

Most Rails security tooling tells you what's wrong once. The interesting question is what's still wrong three months later.

A home environment that started as a place to run Security Onion and Splunk and has turned into somewhere coding agents run unattended. Persistent sessions, jobs that survive a closed laptop, and enough observability to tell which agent is stuck.

A self-hosted punch clock, built to replace Clockify. One running timer at a time — enforced by a partial unique index rather than by application-level hope — with live state shared across every connected device, so you can start a timer at your desk and stop it from your phone.

Deliberately single-user: no accounts, no teams, no approval workflows. The entire database is one SQLite file, snapshotted nightly with VACUUM INTO.

Capture-the-flag competitions and independent reverse engineering — historically a lot of iOS work, including private API analysis via intercepting proxies on jailbroken devices. It's the part of security that keeps the defensive work honest about what an attacker will actually invest effort in.

Things built to solve one problem and then left running: a Raspberry Pi humidity monitor feeding InfluxDB and Grafana, and a timelapse capture tool that pulls frames from an MJPEG stream.