Binary analysis platform: kickstarted it from scratch and built the multi-algorithm similarity engine (vector similarity, string/callgraph hashing, microcode/IR dataflow hashing).
Binary ingestion pipeline: auto-scaling crawlers, analysis workers and a search engine ingesting open-source and proprietary software weekly to generate signatures for downstream analysis services.
experience
Options market-maker. Worked on the internal trading UI (Rust + ImGui), scenario pricing, and risk modeling over live market data. 3 months internship converted into a permanent role.
Internal security at a multi-strategy hedge fund: reverse engineering and vendor-risk assessments of third-party software and mobile apps, custom tooling.
Big Match: search engine that identifies the open-source libraries linked into a compiled binary, using GitHub as the corpus. Solo research project. demo blog bashML HITB Phuket 2023 talk
LLVM-based s390-to-x86 JIT for LZLabs Software Defined Mainframe. Main developer for ~7 months, now in production at a major Swiss bank.
QEMU Hexagon: bison-driven pipeline from the Qualcomm ISA spec to TCG generators, validated by differential testing against the reference emulator. Collaboration with Qualcomm.
Run the team's public presence: social media, video and content production, sponsor relations, merchandise. On site at DEF CON 2023 for logistics and filming when the team won the Hack-A-Sat finals.
Two-person startup in collaboration with Pittarosso, a large Italian apparel retailer: deep-learning proof of concept for shoe type, brand, and color recognition from in-store video, taken to executive-level talks. Owned dataset creation, CNN training, and evaluation.
Built COBOL reverse-engineering tools, contributed to the team's Haskell codebase, and built web-based visualizations of legacy systems from source-code metadata. Internship arranged through the Vulcanus in Japan program.
selected projects
Turns integer comparisons into pixel comparisons against procedurally drawn hands, exploiting LLMs' inability to count fingers. Statically specialized via Futamura projection. Held off Claude Code and Codex on a keygen challenge for a surprisingly long time.
Recovers the token grammar of a flex-generated lexer from the DFA tables embedded in a binary. Born from a DEF CON CTF challenge and presented at CODE BLUE 2020.
education
talks
awards
independent security research
MikroTik RouterOS SMB DoS (CVE-2019-16160) · Outlook Web App / Exchange 2013 (HTML-sanitization 0-day) · SentinelOne (stored XSS) · Naver LINE 2018 Bug Bounty Hall of Fame · TIM/Telecom Italia 2018 Responsible Disclosure Hall of Fame · United Airlines bug bounty · others on request.