Senior Security Engineer · Cloud, AppSec & AI Security · Toronto

I make the secure path the easy one.

Senior security engineer, hands-on across cloud, application, and AI security. I secure AWS, wire security into CI/CD, threat model before code ships, and I go deep on authorization and multi-tenant SaaS risk. I built Eidolon, an open-source security agent, and I lead Canada's largest hacker community.

120+

Validated vulnerabilities

Years in security

20+

Enterprise clients tested

10+

Conference talks

What I Do

I'm a senior security engineer who works hands-on across cloud, application, and AI security. I secure AWS, IAM and least-privilege, secrets, and misconfiguration, I wire SAST, dependency, and container scanning into CI/CD without the noise that makes developers ignore it, and I threat model new products and APIs before they ship.

My specialty is authorization and multi-tenant SaaS risk, which for a platform handling sensitive financial data is most of the game, backed by 120+ validated vulnerabilities through HackerOne. On the AI side, I review LLM and agent workflows for data leakage, prompt injection, and excessive permissions, and I built Eidolon, an open-source orchestrator that runs security workflows with an agent under scope tokens and command gating, because an agent with more access than the user is the whole risk.

I have also led incident response end to end, from investigation and containment through root-cause and runbooks, and I build reusable tooling so a control gets written once and reused everywhere. I lead DEF CON Toronto (DC416) and speak at SecTor and DEF CON Vancouver.

How I Work

Model the design, not just the build

A trust boundary drawn wrong on a whiteboard costs an afternoon. The same mistake in production costs a quarter. I model abuse cases with the engineers who wrote the doc.

Tune the tooling, don't just install it

A scanner at default settings buries a team in noise until they stop reading it, which is worse than nothing. I'd rather ship five findings a week that are all real than five hundred that aren't.

One bug, or a bug class

Findings get traced to root cause, then checked for the same pattern everywhere else. One IDOR is a bug. The same authorization mistake in nine places is a design problem.

Where I've Worked

White Tuque, Offensive Security Specialist

Toronto · Oct 2024 to Present

Run threat modeling and security architecture reviews for new products, APIs, and integrations across web, API, and cloud for 20+ clients weighted toward SaaS and fintech, focused on authorization enforcement and multi-tenant isolation. Review AWS for IAM and least-privilege, secrets, and misconfiguration, and wire SAST, dependency, and container scanning into CI/CD. Review AI and agentic workflows so agents operate within the calling user's permissions. Build reusable tooling that makes the secure path the easy one.

ASEC, Penetration Tester

Toronto · May 2024 to Oct 2024

Application security assessments for fintech and financial services clients across Canada, the US, Australia, and Europe, under Nick Aleks, former Senior Director of Security at Wealthsimple and now Head of Security at Robinhood. 150+ vulnerabilities across web, REST and GraphQL APIs, and cloud infrastructure.

Ofogh Kourosh Chain Stores, Lead Security Architect

Tehran · 2023 to Feb 2024

Built the company's first detection and response capability and its incident response playbooks and CSIRP from the ground up, defining the response procedures the organization ran against. Set the security design and standards new systems shipped against as the chain scaled from roughly 200 to 1,000 stores, building defense-in-depth into the architecture.

Ofogh Kourosh Chain Stores, Security Engineer

Tehran · Sep 2021 to 2023

Ran centralized logging, monitoring, and vulnerability scanning across a growing multi-site estate, and wrote detection and automation tooling in Python and Bash. Built network segmentation, hardening baselines, and identity and access management at scale, and introduced security checks into the software delivery process.

Ofogh Kourosh Chain Stores, Security Analyst

Tehran · Jun 2020 to Sep 2021

As the primary security resource, served as incident commander on live incidents across corporate and store infrastructure, from detection and triage through containment and lessons learned. Investigated and responded to malware, phishing, and account compromise, with remediation tracked to closure.

DEF CON Toronto (DC416), Lead Organizer

Toronto · 2025 to Present

Lead Canada's largest hacker community: monthly meetups, speaker programming, sponsorships, and events including the AI Fight Club workshop hosted at Palo Alto Networks. Also on the organizing committee for TASK, Toronto's longest-running security community.

HackerOne, Security Researcher

Remote · Feb 2022 to Present

120+ validated vulnerabilities across Fortune 500 disclosure programs. Focus on authentication and authorization bypass, privilege escalation, and multi-step business logic chains across web and API surfaces.

Projects & Research

API Authorization Testing Extension

A Burp Suite extension I built that automates OAuth2.0 and OIDC authorization-bypass detection across API surfaces. Auth is where identity systems break, so I made the bug class easier to find.

Eidolon

Open source (MIT), built and maintained in Python. A security orchestrator that automates testing by driving an AI agent, with per-engagement isolation, scope tokens, and three-tier command gating, so the agent earns trust one step at a time. github.com/amir-hosseinpour/eidolon →

Talks & research

SecTor 2025 and DEF CON Vancouver (API attack chains and OAuth2.0 exploitation), plus a firmware teardown of a robot vacuum under the vendor's bug bounty program. I share the work rather than hide it.