Portfolio and résumé · Brisbane, Australia
AI engineer, end to end. Grounded in cybersecurity.
I scope, design, build and deploy AI solutions: agents, the knowledge they work from and the controls around them, handed over as something the team can run.
Underneath that sit thirteen years in cybersecurity, IT infrastructure and operational technology, including seven running IT and OT for remote gas operations. Most recently I've been Senior Engineer, Secure AI at CyberCX, then Security Transformation Specialist at Accenture, working as a forward deployed engineer. I'm based in Brisbane.
01 Selected work
Work you can open and check. Each piece says what it is and when I made it.
Every project was accurate at the time of writing. My tools and methods have moved on since some of them, so treat the older pieces as a record of how I worked at the time.
Interactive capstone
October 2026.
The capstone of the Offerings Atlas, and the part you can try. Tell it where you are with AI agents, what you run and what worries you, and watch it walk the knowledge base to an answer in which every citation is checked against the record it came from.
Knowledge base case study
Built 6 to 10 October 2026.
I built a knowledge base of AI agent security controls that agents research, verify and keep current. It covers 151 platforms and tools, and an enterprise questionnaire answers a client's concerns from it with every citation checked against the knowledge base itself.
Personal tooling
October 2026.
I built a personal gateway that gives every agent I write one OpenAI-compatible endpoint. Role aliases decide whether a call goes to headless Claude Code, headless Codex or an API model, and every call leaves a proof record.
Agent build case study
First live cloud run 27 September 2026.
I designed and built a custom AI agent that runs in the cloud, draws everything it knows from an open knowledge base, and can only act inside policy written as code. I tested it on a live, high-stakes domain: my own job search.
Practitioner reference
Version 1.4, evidence cut 23 September 2026.
A reference for administrators on what the Claude Cowork admin console, device policy (MDM) and third-party deployments on Bedrock, Vertex and Foundry actually control, where they fall short, and which defaults to change first. 65 references, checked against Anthropic's documentation.
SOC advisory white paper
Version 5, evidence cut 23 September 2026.
A SOC advisory paper on telling AI-driven attack activity apart from human and automated activity. From logs alone the evidence supports a confidence score, not attribution. The paper covers which indicators carry signal, the detection methods now emerging, and what that means for response. 19 references.
Study game
First released July 2026, last updated September 2026.
A pixel-art side-scroller I built to study for the Claude Certified Architect, Foundations exam. Question terminals sit along each stage, each act ends in a boss fight, and there are endless and timed mock exam modes. Phaser and TypeScript, playable in the browser.
Portfolio proof of concept
May to July 2026. My approach to MCP governance has moved on since.
A working demonstration of structured review for AI agent integrations and MCP-connected tools. The portfolio uses fictional vendors and mock intake data to show request intake, risk classification, human review and decision evidence.
Portfolio proof of concept. Not a production deployment, certification or attestation.
Open-source tool
First released June 2026, last updated July 2026. Parts of it may since have been overtaken by newer tooling.
A command-line pipeline that takes several AI deep-research reports on one topic and consolidates them into a single verified master document. It follows systematic review methods: every claim keeps its source, conflicts are handled in the open, and completeness is checked by machine.
The pipeline has no runtime AI dependency. Any assistant can drive it, and every stage can be rerun and inspected from the shell.
Fictional case study
April 2026. AWS services and guidance change often.
A fictional case study for Rossco's Coffee, covering security architecture and migration planning. The portfolio considers identity and access, network boundaries, resilience, monitoring and recovery, supported by a testing and deployment plan.
This is a planning case study. The architecture is proposed rather than presented as a live production system.
Planning portfolio
April 2026.
A practical incident response planning portfolio structured around NIST SP 800-61. It covers response roles, communications, escalation, evidence handling, recovery and post-incident review.
This page describes a portfolio document, not a live customer programme.
Self-directed research
A knowledge base designed for agent use. Agents propose updates as pull requests, accountable people review them before anything merges, and access is scoped so an agent only reaches the knowledge it is cleared to see.
Write-up coming soon
Architecture
A reference architecture that keeps the logical design independent of any one cloud or model, with a capability matrix that compares major AI platforms against the same set of security controls.
Coming soon
02 Résumé
IT and OT infrastructure from breaking ground to operations, then cloud engineering and cybersecurity. Now I build and secure AI systems, from LLMs to agents. Each step has been about making technology hold up where it runs.
June to October 2026
Senior Engineer, Secure AI at CyberCX from June to September 2026, then Security Transformation Specialist at Accenture from September to October 2026, an equivalent role with more forward deployed work.
2025 to 2026
Contract work for clients as an independent practitioner, alongside a focused stretch of study and certification.
May 2019 to August 2025
Tata Consultancy Services
Embedded contractor running IT and OT for Shell QGC and QCLNG upstream and midstream operations in Queensland, on the same assets I had helped build and commission in earlier site roles.
January to May 2019
Data#3
Field engineering and cutover coordination for the Shell QGC Enterprise Network Transformation project.
2005 to 2019
QGC site roles with MSS, ECM and Protech (2012 to 2019), on gas plant projects from breaking ground through construction and commissioning to handover into operations. Before that, lighting and sound engineering with Airco Audio in the USA (2005 to 2012), running networked lighting and audio control systems for live production.
03 Practice
Models get better every few months. Whatever I build has to still be worth having when they do, and it has to be secure from the first design decision.
I work with the client team from scoping to handover.
I scope the use case, design the architecture, build the agents, tools and workflows, put the controls in place and hand over something the team can operate.
Recent work includes custom AI plugins, versioned workflow packaging, document generation and review processes, built with Claude, Codex, ChatGPT, Python, PowerShell, MCP and n8n.
See RESYNTH on GitHubMake AI useful. Keep it defensible.
I build security in from the first design decision. The work covers AI threat modelling, secure software development, MCP governance, access boundaries and control assessment, with findings written up as guidance people can implement.
I treat an agent's reach into data as an access control decision. An agent that can only reach what it is permitted to see has a smaller blast radius, and a document it can't open can't prompt-inject it.
See the governance projectThe layer I'm working through most deeply right now.
I build knowledge bases agents can reason over, from graph ontologies and vector-searchable knowledge graphs to open-format repositories. They come with ingestion, retrieval and provenance tooling, and people decide what counts as true.
See the Offerings AtlasSeven years running technology where distance, access and service continuity had immediate operational consequences.
That still shapes my AI delivery. I design for the people who will run the system, and I make sure the handover works for them.
See the experienceKnowledge is the layer I've worked through most so far. An agent should read knowledge that an accountable person approved, that carries its source, and that expires before it goes stale. Agents propose updates as pull requests, and people review them before anything merges. Each agent only reaches what it's cleared to see.
I don't tie a build to one model or vendor. The model is a swappable part, so I use open formats in plain markdown, standard protocols such as MCP, and agent instructions any assistant can read.
Brisbane, Australia
Recruiters, employers and teams doing worthwhile security or AI work are welcome to email me or find me on LinkedIn.
Based in Brisbane. Remote suits me best, and for the right opportunity I'd consider hybrid or relocating.
