Technical operations leader and hands-on software builder working across secure systems, macOS, Go, Python, media infrastructure, hardware integration, and evidence-first security research.
I spent more than 18 years leading public-facing broadcast and technology operations: servers, storage, fiber networks, production systems, remote facilities, incident response, documentation, vendors, and major changes with zero broadcast downtime. My current work turns that operational discipline into tested open-source software and responsible security tooling.
Based near Boston, Massachusetts. Available for remote US roles spanning technical operations, systems engineering, security analysis, developer tooling, media technology, and applied AI automation.
- Surfaceproof — evidence-first auditing of explicitly scoped public web artifacts. Exact-host containment, hard request/byte budgets, contextual classification, redaction by default, JSON/Markdown/SARIF output, and fingerprint-only run comparison.
- Responsible Security Research — six sanitized case studies covering browser-delivered credentials, JavaScript/source-map review, passive attack-surface analysis, publication-state integrity, renderer security, and bounded negative results.
- rongta-f11-open — clean-room, blob-free driver and PDF printing stack for the Rongta F11, with Swift, Go, USB protocol work, tested releases, and reproducible verification.
- macftpd — Go FTP service with HTTP administration, JSON APIs, users/groups, permission controls, storage-root containment, launchd deployment, Cloudflare examples, smoke tests, and security documentation.
- eversmart — privacy-conscious authenticated utility-data retrieval and local smart-meter dashboard using Python and Opower/Eversource workflows.
- nesn-player-macos — native Swift macOS player for authenticated subscribers using AVFoundation and FairPlay, without transcoding or DRM bypass.
- macwamp — native Apple Silicon Winamp-classic recreation in Swift/AppKit with local media import and playback.
- Verify the real artifact and user-visible result—not merely the build command.
- Treat authorization, privacy, scope, and evidence handling as engineering requirements.
- Prefer small, auditable systems with explicit failure behavior and reproducible checks.
- Distinguish observations, inferences, false positives, unknowns, and confirmed impact.
- Build for operators: useful defaults, clear status, runbooks, and honest limitations.
Languages: Go, Python, Swift, JavaScript, shell, SQL
Platforms: macOS, Linux, Windows, iOS, AWS, Azure, Cloudflare
Systems: REST/JSON APIs, FastAPI, SQLite/SQLAlchemy, networking, storage, USB, AVFoundation, media pipelines, background services, CI/CD
Security: passive public-surface analysis, static web artifacts, evidence minimization, redaction, SARIF, threat modeling, responsible disclosure
Operations: incident response, root-cause analysis, SOPs, continuity, vendor coordination, technical leadership, broadcast and AV infrastructure
For project questions, use the relevant repository's Issues or Discussions. For sensitive security matters, follow that repository's SECURITY.md and use a private GitHub Security Advisory.