I test machine learning systems the way an attacker would, then stay long enough to help fix what I find. Most of my work sits in three places: the prompt and tool boundary of agentic systems, the data and weights supply chain behind a model, and the detection layer that has to notice when either one is being abused.
Before AI security, I spent my time in ordinary application security — web, cloud, identity — and that grounding still shapes how I work. A model is a component in a system, and most incidents involving one are still failures of trust boundaries, logging, and least privilege. I write findings so an engineer can act on them the same week, and I build the test that keeps the bug from returning.
Two to six weeks against a live system: prompt and tool-boundary abuse, retrieval poisoning, agent privilege escalation, model and prompt extraction. You get reproducible cases, severity with reasoning, and a regression suite that runs in your CI.
A structured review of where a model touches untrusted data, who can influence training, and what an attacker gets for compromising each component. Delivered as a diagram your team argues over, not a PDF nobody reopens.
Instrumenting inference paths and training pipelines so abuse is visible: extraction-shaped query patterns, anomalous tool use, unsigned artifacts reaching deploy. Rules land in the tooling your on-call already watches.
A working session that turns the research into habits — what to log, which boundaries to distrust, how to review a feature that puts a model in front of user data. Run for product, platform, and security teams together.