Application Security · DevSecOps & Agentic Security · Toronto

I build the security tooling, then teach it to run itself.

Application security engineer who builds tools, not just findings. I wire security into CI/CD, threat model the hard changes, and build the agent tooling that does the first pass. I wrote Eidolon, an open-source orchestrator that drives Claude Code, and I lead Canada's largest hacker community.

120+

Validated vulnerabilities

Years in security

20+

Enterprise clients tested

10+

Conference talks

What I Do

I'm an application security engineer who builds the tooling. I wire SAST, DAST, SCA, and secret scanning into CI/CD so findings land where developers already work, threat model architectural changes, and run triage that retires risk instead of growing a backlog.

The part I care about most is the agent side. I build agent tooling, not just use it. I wrote Eidolon, an open-source orchestrator that drives Claude Code through security workflows, with per-engagement isolation, scope tokens, and three-tier command gating, because an agent with write access needs to earn trust one step at a time. I've thought hard about where agentic systems break, prompt injection, tool-permission scoping, credential handling, and I teach it in a hands-on workshop.

Under all of it is an offensive background: 120+ validated vulnerabilities through HackerOne, deep OWASP and CWE work, which is most of why I can tell a real finding from a plausible one. I lead DEF CON Toronto (DC416) and speak at SecTor and DEF CON Vancouver.

How I Work

Model the design, not just the build

A trust boundary drawn wrong on a whiteboard costs an afternoon. The same mistake in production costs a quarter. I model abuse cases with the engineers who wrote the doc.

Tune the tooling, don't just install it

A scanner at default settings buries a team in noise until they stop reading it, which is worse than nothing. I'd rather ship five findings a week that are all real than five hundred that aren't.

One bug, or a bug class

Findings get traced to root cause, then checked for the same pattern everywhere else. One IDOR is a bug. The same authorization mistake in nine places is a design problem.

Where I've Worked

White Tuque, Offensive Security Specialist

Toronto · Oct 2024 to Present

Integrate SAST, DAST, SCA, and secret scanning into developer and CI/CD workflows for 20+ enterprise clients, tuned so findings land where developers work and get fixed. Build agent tooling for security, including Eidolon, an orchestrator that drives Claude Code with scope tokens and command gating. Threat model architectural changes, run vulnerability triage that retires risk, and review code alongside dynamic testing. Explain a risk tradeoff to an engineer and to leadership without blocking releases.

ASEC, Penetration Tester

Toronto · May 2024 to Oct 2024

Application security assessments for fintech and financial services clients across Canada, the US, Australia, and Europe, under Nick Aleks, former Senior Director of Security at Wealthsimple and now Head of Security at Robinhood. 150+ vulnerabilities across web, REST and GraphQL APIs, and cloud infrastructure.

Ofogh Kourosh Chain Stores, Lead Security Architect

Tehran · 2023 to Feb 2024

Built the company's first detection and response capability and its incident response playbooks and CSIRP from the ground up, defining the response procedures the organization ran against. Set the security design and standards new systems shipped against as the chain scaled from roughly 200 to 1,000 stores, building defense-in-depth into the architecture.

Ofogh Kourosh Chain Stores, Security Engineer

Tehran · Sep 2021 to 2023

Ran centralized logging, monitoring, and vulnerability scanning across a growing multi-site estate, and wrote detection and automation tooling in Python and Bash. Built network segmentation, hardening baselines, and identity and access management at scale, and introduced security checks into the software delivery process.

Ofogh Kourosh Chain Stores, Security Analyst

Tehran · Jun 2020 to Sep 2021

As the primary security resource, served as incident commander on live incidents across corporate and store infrastructure, from detection and triage through containment and lessons learned. Investigated and responded to malware, phishing, and account compromise, with remediation tracked to closure.

DEF CON Toronto (DC416), Lead Organizer

Toronto · 2025 to Present

Lead Canada's largest hacker community: monthly meetups, speaker programming, sponsorships, and events including the AI Fight Club workshop hosted at Palo Alto Networks. Also on the organizing committee for TASK, Toronto's longest-running security community.

HackerOne, Security Researcher

Remote · Feb 2022 to Present

120+ validated vulnerabilities across Fortune 500 disclosure programs. Focus on authentication and authorization bypass, privilege escalation, and multi-step business logic chains across web and API surfaces.

Projects & Research

Eidolon — agent tooling that drives Claude Code

Open source (MIT), built and maintained in Python. An orchestrator that drives Claude Code through security workflows, with per-engagement isolation, scope tokens, a hash-chained audit log, and three-tier command gating, because an agent with repo access needs to earn trust one step at a time. github.com/amir-hosseinpour/eidolon →

Ecovacs Deebot teardown

Hardware and firmware security research under the vendor's bug bounty program. UART console access, firmware extraction, then up through the cloud API and mobile app.

Offensive tooling

Burp Suite extension for automated OAuth2.0 and OIDC authorization-bypass detection, and a Nuclei template library for API and application vulnerability discovery.