|
SECURITY ENGINEER · BERLIN, GERMANY · OPEN TO EU ROLES I build and break the security layer around LLM applications — prompt-injection defence, API and application security testing, and turning findings into tooling that survives contact with production traffic. ● Independent security researcher · finishing an MSc in AI · #1 Intigriti quarterly leaderboard
|
|
Security Engineer — AI/LLM security, application & product security, vulnerability research. |
Prompt-injection defence · detection engineering · secure code review · coordinated disclosure. |
Berlin, Germany · open to security roles across the EU. Dual MSc (Cyber Security + AI, in progress). |
| #1 Intigriti quarterly leaderboard (RO07 Ch13f) |
CVSS 9.9 disclosed sandbox escape (CWE-94) |
0.7895 held-out recall — the honest number |
4 external benchmarks on the flagship |
Two-tier prompt-injection detection for production LLM serving. Sub-millisecond on the common path, evaluated against four external benchmarks.
| Evaluation | Tier 1 recall | FPR |
|---|---|---|
| In-house corpus (in-sample) | 1.000 | 0.000 |
| Held-out split — the honest number | 0.7895 | 0.000 |
Open-Prompt-Injection (source="data") |
1.000 | 0.006 |
BIPIA (source="data") |
0.480 | 0.017 |
| NotInject (over-defense, benign only) | — | 0.000 |
The headline result is not the 1.000. It is the 21-point gap between the in-sample score and the held-out one. Tier 1's blocklist was tuned by inspecting the attacks it missed on that corpus, so the perfect score is partly memorisation — the repo says so, quantifies it, and ships the split script that proves it.
Design decisions I can defend in an interview:
- Tier 1 — Aho-Corasick + regex over normalised text, scanned twice: once preserving
structural markers (
<|im_start|>,safety_mode=off), once de-obfuscated to catch1gn0r3 prev10us 1nstruct10ns. p50 0.14 ms. - Tier 2 is monitor-only, deliberately. DeBERTa-v3 ONNX scores and logs but does not block, because on NotInject it rejects 40.4% of benign prompts against Tier 1's 0.0%, and the over-defense is not threshold-separable. The cost is a recall ceiling. Both operating points are published.
- Fail-open. If the Tier 2 model errors, the request is allowed. Availability over semantic coverage, stated rather than defaulted into.
- A content-safety baseline (Llama-Guard-3-8B) misses 165/190 attacks here — reported as "content-safety guardrails don't transfer to prompt injection", not as a 7× win.
|
Deliberately vulnerable AWS AI-agent security lab — attack, detect, remediate. Terraform-provisioned, with Sigma detections and an AppSec CI gate. Python · Terraform · Sigma · AWS |
Home SOC detection-engineering lab: Wazuh + Sysmon, ATT&CK techniques detonated with Atomic Red Team, caught with hand-authored Sigma rules, plus an evaluated AI triage layer — 7/10 detected, gaps documented. Wazuh · Sysmon · MITRE ATT&CK · Sigma |
|
Six web vulnerabilities (SQLi, IDOR, SSRF, XSS, JWT-bypass, prototype pollution), each with a working exploit, a fix, a custom Semgrep rule, and a CI gate that fails the build if it returns. SAST gate goes 7 → 0. TypeScript · Semgrep · CI/CD · OWASP |
Stops indirect prompt injection — hidden white-on-white instructions in a résumé that hijack an LLM applicant tracking system. 0% false positives across 1,200 résumés; 98.8% in-sample recall, 42.9% held-out (reported honestly). Python · OWASP LLM01 · Unicode normalisation |
|
Network IDS on CICIDS2017 across six attack classes with SHAP explanations, so an analyst gets why a flow was flagged, not just a label. Python · scikit-learn · SHAP · CICIDS2017 |
Cited, machine-readable control-to-framework crosswalk — ISO 27001, NIST CSF, SOC 2, CIS, GDPR — with a confidence grade and primary-source URL per mapping, published as a fetchable dataset and validated in CI. Next.js · GRC · ISO 27001 · SOC 2 |
Private bug bounty and coordinated disclosure. Statuses are reported as they resolved — duplicates and informatives included, because the methodology is the transferable part.
| Finding | Class | Impact | Status |
|---|---|---|---|
Python sandbox escape in smolagents |
CWE-94 · CVSS 9.9 | Arbitrary host command execution | Disclosed via huntr |
Path-traversal detection bypass, Aikido firewall-java |
Security-control bypass | Defeats WAF path-traversal detection | Disclosed via Intigriti |
| Unauthenticated GraphQL bulk pagination | API1 / API4 | 57.3M user records enumerable, no rate limit | Duplicate (confirmed valid) |
| Unrestricted Google Maps API keys in page source | CWE-798 | ~$121/hr billable abuse, measured | Duplicate / P4 |
CORS origin reflection + credentials: true |
CWE-942 | Full account takeover via one link | Duplicate |
| Dangling Route53 NS delegation | Subdomain takeover | HTTPS phishing + session-cookie theft | Informative |
🥇 #1 Quarterly Leaderboard (RO07 Ch13f) and Top 10 Quarterly (Bug Baron) on Intigriti.
Domains — AI/LLM security (prompt injection · RAG security · OWASP LLM Top 10 · NIST AI RMF · guardrail architecture) · application & API security (OWASP Top 10 · STRIDE threat modelling · secure code review · detection-as-code) · offensive security & vulnerability research · detection engineering · cloud & GRC (ISO 27001 · NIST CSF · SOC 2 · GDPR).
| Credential | Issuer | Date |
|---|---|---|
| AWS Certified Security — Specialty | Amazon Web Services | Aug 2026 → Aug 2029 |
| AWS Certified Solutions Architect — Associate | Amazon Web Services | Aug 2026 → Aug 2029 |
| Certified LLM Security Professional (CLLMSP) | Red Team Leaders | Jun 2026 |
| Fortinet Certified Associate in Cybersecurity | Fortinet | Oct 2025 → Oct 2027 |
| OCI 2025 Certified AI Foundations Associate | Oracle | Aug 2025 |
| Certified Network Security Specialist (CNSS) | ICSI, UK | Jul 2020 |
|
Open to AI/LLM security, application & product security, and detection-engineering roles across the EU. Happy to walk through any result here — including the ones that came back as duplicates. |
Portfolio Medium write-ups prateekpulastya220@gmail.com |
English (professional) · German (A2, improving) · Spanish (elementary)