A technical record, not a one-page abstraction.

• Offensive security for Android's device-attestation stack: hardware-backed attestation and verified boot from secure element and TEE through the OS.
• Hypervisor-assisted runtime kernel integrity measurement across the post-boot trust boundary.

• Four years on Square's POS team across payment-terminal hardware security—firmware integrity, secure boot, and tamper detection—and mobile device trust.
• Owned threat-signal research for iOS and Android: selected signals, implemented collection on both platforms, and built backend threat analysis across millions of devices and hundreds of thousands of transactions a day.

Mobile security red-team work across Android and iOS.

Founding security engineer at the YC S15 mobile binary-analysis company, acquired by Apple.

Embedded code auditing, low-level security tooling, and fuzzing research.

U-Boot NFS client

Independently found a pre-auth buffer overflow in U-Boot's NFS client — pointer hijack, NFS state-machine takeover, shellcode delivery, full chain and public PoC. It collided with a private report filed a month earlier, so the CVE went to the other reporter. Patches are upstream, including a second negative-length bug in nfs_read_reply() found on the way.

Hardware wallets

Voltage fault injection to bypass RDP2 read-out protection on STM32F2; extracted seeds off bootrom startup. Trezor One and Model T.

Nur security-SDK census

Collected a real, dated census of security and identity SDK code detected in 320 public mobile app binaries using 27 fingerprint signatures. The artifact reports code presence only—not use, configuration, effectiveness, or market share.

Device integrity

Named inventor on a U.S. patent covering device integrity and TEE isolation for payments.