Understanding attack paths. Building trustworthy AI systems.
I’m a cybersecurity consultant and AI practitioner with 3+ years of Big Four experience. My work spans application security, AI agent security, and the engineering that turns ideas into useful tools.
Tool policies, human approval, evidence & telemetry
Engineering
Python / TypeScript / REST APIs / SQL
Playwright, workflow automation & prototyping
02 / EXPERIENCE
Turning risk into action
Jul 2025 — Present
Senior Cybersecurity Consultant
Ernst & Young Advisory Pte. Ltd. · Singapore
Lead security engagements from scoping and test planning through vulnerability validation, remediation discussions, and final report quality assurance.
Assess web applications, APIs, mobile applications, internal networks, and AI chatbots and agents, with a focus on attack paths, reproducibility, and evidence quality.
Communicate technical risk and business impact to engineering and management teams, coordinate workstreams, and mentor associates and interns.
Jul 2023 — Jun 2025
Cybersecurity Consultant
Ernst & Young Advisory Pte. Ltd. · Singapore
Delivered penetration tests and technical security assessments for finance, telecommunications, and public-sector clients; validated high-risk findings and documented attack steps and impact.
Worked with developers and system owners through remediation and retesting, clarifying fixes and residual risk.
Built reusable scripts, checklists, and workflows to improve evidence collection, assessment coverage, and repeatability.
03 / SELECTED PROJECTS
From ideas to useful tools
01
Yeshua
MVP · Ongoing R&D
Autonomous pentesting platform
A working MVP for scoped agent execution, checklist-based coverage, evidence review, and report generation. Ongoing work focuses on controllability, traceability, and reliable findings.
Python and TypeScript controls for tool-execution policies, human approval, session risk tracking, and telemetry, with OpenAI tool-call adapters and reusable integrations.
A Python-validated state tracker and Markdown dashboard that separates verified facts from hypotheses, tracks coverage and stale state, and preserves evidence for handoffs and reporting.
PythonEvidenceWorkflow
04 / RESEARCH & RECOGNITION
2026 · Independent research preprint
Resource-Operating AI Agent Security Evaluation
Independent research into how prompt manipulation escalates into unauthorized tool and resource actions. Developed an attack taxonomy and evaluation workflows, alongside M2E, a browser annotation tool with a 180-trace sample for inspection, collaborator review, and export.