Offensive Security Engineer — Red Team & AI Security Automation
Six years in offensive security, now building agent-assisted workflows that scale reconnaissance, vulnerability discovery, and reporting. Creator of two open-source AI-security frameworks for authorized security research.
Public repository and installation metrics, recorded August 10, 2026. Verify live values on the linked sources.
elementalsouls
I sit at the intersection of offensive security and applied AI — an OSCP/CRTO red teamer who now designs the LLM agents that automate the work. Across roles at Grant Thornton and EY I've led red team operations for Fortune 500 clients, cut manual tradecraft by more than half with GenAI-driven workflows, and open-sourced the tooling behind it. Claude-BugHunter has recorded 5,200+ installs through skills.sh alongside public GitHub adoption.
Anonymized examples of the operating problems I solve across red teaming, exposure monitoring, application security, and threat intelligence.
Role: led internal and external red-team operations for large enterprise clients. Combined attack-path analysis, adversary simulation, and remediation planning to help teams reduce exploitable exposure.
Role: designed an N8N workflow for collection, normalization, prioritization, and escalation of credential-exposure signals. The program surfaced 50,000+ records for triage without publishing sensitive values.
Role: delivered 40+ red-team and application-security engagements across banking, financial services, insurance, healthcare, and energy, pairing technical validation with remediation-focused reporting.
Client names, targets, and sensitive evidence are intentionally withheld. Detailed methodology and references can be discussed in a qualified hiring or research conversation.
Autonomous agent tooling that turns LLM assistants into structured recon-to-report workflows, with public repositories and external adoption signals.
An AI agent skill framework that turns LLM coding assistants into structured bug-hunting & red-team copilots.
Its evidence base curates 681 disclosed-vulnerability patterns from real HackerOne & Bugcrowd reports, driving a repeatable six-phase recon-to-report workflow that runs across Claude Code, Codex & OpenCode.
Research angleCan LLM agents reliably triage real vulnerability classes end-to-end — where do they succeed, and where do they silently fail?
An AI reconnaissance framework with eight modular skills and roughly 10,000 lines of structured tradecraft for authorized external-attack-surface research.
Automates identity/SSO mapping (Entra, M365, Okta, ADFS), cloud & Kubernetes exposure discovery, and email-security auditing (SPF/DMARC/DKIM) — with sector packs for healthcare, finance, ICS/SCADA & government.
Research angleHow far can autonomous agents map an organization's external attack surface from open-source signal alone — and how noisy is that signal?
Read the architecture, skill catalog, and evaluation material before treating either project as a black box.
Selected third-party articles, directories, and specialist newsletters that mention or analyze Claude-BugHunter and Claude-OSINT. Coverage is labeled by source type so the evidence stays easy to audit.
An editorial analysis of Claude-OSINT’s skill-based architecture, investigative workflows, practical value, and responsible-use boundaries.
Read article ↗The specialist newsletter selected Claude-OSINT for its tools section and described it as a framework for structured investigative workflows.
Read issue ↗A long-form overview of the framework’s six-phase workflow, vulnerability-class coverage, validation gates, reporting discipline, and authorized-use posture.
Read article ↗A directory analysis that positions Claude-OSINT as a Claude-native methodology layer, and notes the boundary between structured guidance and a full scanner.
Read analysis ↗A community project listing that explains the skill-and-command model, disclosed-report corpus, and intended bug-bounty and red-team use cases.
Read listing ↗I want to study the systems I've been building by instinct: how autonomous offensive agents actually behave, where they break, and how to make them measurable and safe. Four threads I'd bring to a lab:
Scaling recon-to-report pipelines with tool-calling agents — planning, orchestration, and reliability under real targets.
Prompt injection, agent memory/RAG poisoning, and jailbreak strategy discovery from the attacker's seat.
Turning noisy open-source and dark-web signal into predictive, operational threat models.
Measuring and containing what autonomous offensive agents can actually do.
# Seeking a Graduate Research Assistantship, Fall 2027 —
# moving from enterprise consulting into rigorous research.
A reproducible evaluation I can run on controlled, authorized lab targets: compare a baseline LLM workflow with skill-assisted and human-in-the-loop conditions, then measure whether structure improves valid findings without increasing scope drift or unsupported claims.
Claude-BugHunter and Claude-OSINT passed 5,600 combined GitHub stars and 940 combined forks. Metrics recorded August 10, 2026. View the repositories.
Seeking a Graduate Research Assistantship for Fall 2027 — reaching out to research groups working on autonomous AI security and adversarial ML.
Claude-OSINT received independent coverage from SecurityInfo.it and The OSINT Newsletter. See the coverage.
Awarded a Spot Award at Grant Thornton for AI-powered offensive tooling and the N8N dark-web monitoring program.
From LLM agent engineering to Active Directory attack paths.
Grant Thornton — for driving AI-powered tooling & N8N dark-web monitoring initiatives and sustained client success.
Ernst & Young — for delivering high-impact red team projects across multiple Fortune 500 clients.
5,600+ combined GitHub stars, 940+ forks, and independent coverage across specialist security and OSINT publications.
Open to senior offensive-security roles, research collaborations, and graduate research assistantships — and always up for a conversation about autonomous red teaming.
