Decades of learning, building, and leading
27 entries
- 2026 – present
poietic.tech
This site — and the thesis it demonstrates: in an age of AI, one person can orchestrate a small business from their consoles and their phone. Full-account infrastructure as code, a validated content model, and every change shipped by directing AI agents through gated CI. First commit to live production in four days; the method is the point.
- 2026 – present
graph-explorer
A Barnes-Hut force layout and WebGL2 renderer in Rust, driven by a typed TypeScript client. Speed over breadth by design — large node and edge counts without choking. Styling is declarative: a JSON document of rules matched against nodes and edges, rather than per-node callbacks.
- 2024 – present
Palo Alto Networks · 20 engineers across 3 teams
Engineering Director, Threat Data Platform
The threat intelligence backbone of the Palo Alto Networks product suite.
Responsible for
- Architecture, operations and deployment of large distributed systems — web interfaces, REST and gRPC services, ML and AI applications, and high-scale data processing pipelines.
- Three teams: data platform engineering, platform services engineering, and research engineering.
- Early architecture and prototyping on new initiatives, personally.
Delivered
- Consolidated fragmented threat intelligence sources into a single reconciled model — schema design, entity resolution, API contract discipline — now consumed internally and across the product suite.
- Drove an AI-first delivery model that compressed major-initiative timelines from years to weeks.
- Bootstrapped Threat Detection Engineering from a personal proof of concept into a team and a production pipeline, then handed it to a principal engineer to scale — a Cloud Spanner graph resolving overlapping entities into bundles that tell a threat's story, with autonomous Gemini and ADK workflows working the data-quality problems it surfaces.
- Shipped an internal expert agent — grounded entirely in retrieved authoritative data rather than the model's own recall, with structured tool calls holding a trust boundary between untrusted users and a semi-sensitive dataset.
- 2026
visual-cortex
Cross-platform screen watching as a Rust crate — capture regions of a display, run detectors over them, and react to what changes. Groundwork for a Diablo 4 screen reader keeping out-of-game state of the player's skills and inventory.
- 2026
browser-terminal
A tmux-like terminal that docks onto any web page, with a shell-like core written in Rust and compiled to WebAssembly.
- 2026
math-visualizer
Interactive mathematics rendered on the GPU — a Rust core compiled to WebAssembly behind a Svelte interface. Two labs: a 3D Sierpinski chaos game, and a Fourier lab that turns typed text into a chain of rotating circles whose tip draws the letters.
- 2026
rpg-theorycraft-engine
A published Rust crate for simulating role-playing-game damage models — configuration compiled into an IR, through full fight simulation with rotation priority, with the maths kept honest by property tests. The engine behind Ben's Diablo 4 and Path of Exile 2 theorycrafting.
- 2026
scap-vc
Maintenance fork of helmerapp/scap
A patched fork of helmerapp/scap for visual-cortex, adding cross-process window capture on macOS and capture calls that return Result instead of panicking.
- 2026
stix-meta-explorer
An interactive reference for the STIX 2.1 specification — the official docs bury the details, and seeing the object graph beats reading it. Browse, search, and visualise every object type and relationship, or ask a small language model that runs entirely in your own browser.
- 2026
stix-rust
One canonical STIX 2.1 parse: a pure-Rust core for patterns, objects, and bundles, with Python, Java, and TypeScript bindings all producing the same intermediate representation — where hand-rolled implementations diverge.
- 2025
typescript-orpc-base
A reference implementation of a type-safe RPC API in TypeScript using oRPC, with a shared client/server contract and Arktype schema validation.
- 2020–2024
Palo Alto Networks · 30 people, 4 sub-teams
Engineering Director, Unit 42
Threat research engineering for Unit 42, operating with startup autonomy inside a public company.
Responsible for
- Security automation, DevOps, and operational intelligence sub-teams.
- Cross-business-unit relationships and partnership with dozens of internal consumers.
Delivered
- Scaled a single threat intelligence research capability across dozens of independent internal teams.
- Grew technical leaders and built career pathways spanning technical, leadership and professional tracks.
- 2019–2021
mud-engine
Three runs at building a MUD server from scratch, after years of maintaining other people's. The 2019 original is Python; the 2020 rewrite is TypeScript and is really a tutorial — six tagged versions walking from a bare TCP server, through line-buffering socket connections, to player identity, each tag readable on its own. A Node attempt followed. Building the thing you spent 2014 preserving turns out to teach you why it was written the way it was. The arc closes a loop that opened at age twelve inside GodWars.
- 2015–2020
Palo Alto Networks · Skunkworks research team
Senior Manager, Global Security Research Team
A rapid-prototyping team for research tooling and data analysis.
Responsible for
- Automated malware analysis tooling, research workflow interfaces, and infrastructure automation.
- DevOps for both production and laboratory research infrastructure.
Delivered
- Designed and wrote the AutoFocus client library from scratch — still foundational to internal tooling.
- 2019
extensible-client-libraries
A pair of small extensible libraries for interfacing with REST APIs — one synchronous, one async — extracting the dual-path pattern that the AutoFocus client library's second generation was built around, into something not tied to a single vendor's API.
- 2015–2019
autofocus-client-library
The open-source Python SDK for the AutoFocus threat intelligence API, written from scratch in 2015 and redesigned in 2018–19. The second generation moved to Python 3 and split into two deliberate paths: a synchronous requests-based client for fetching and normalising data, and an asyncio/aiohttp client for high-throughput consumers. It underpins substantial internal tooling at Palo Alto Networks and public downstream projects.
- 2015
Ionic Security · Startup security organisation
Director, Security Operations
Built and grew security operations at an Atlanta security startup.
Responsible for
- The security operations organisation: hiring, process, and operational clarity.
- Architectural guidance for secure network and system design.
Delivered
- Enabled analysts and engineers through better process and tooling rather than headcount.
- 2014–2015
Blizzard Entertainment · 15-person security org, hundreds of engineers supported
Senior Security Engineer
Senior technical security voice across game teams that operated as independent studios.
Responsible for
- Security architecture guidance across network, system and application domains, in a federated studio model.
- WAF policy design and tuning for customer-facing systems; DDoS mitigation on Imperva appliances.
- Incident response leadership when escalations needed a senior technical voice.
Delivered
- Partnered with GRC to translate technical capability into compliance requirements.
- Ran content analysis on game releases to validate secure delivery.
- 2014–2015
godwars
Maintenance fork of GodWars Deluxe
A maintenance fork of GodWars Deluxe — cleaning, securing, and preserving the classic MUD codebase Ben learned C inside at twelve.
- 2014
bitsquat-responder
A small DNS server answering bitsquatted-domain lookups under xinetd — half of a honeypot rig that proved squatted domains catch real attacks.
- 2014
merc
Maintenance fork of Merc 2.2 MUD codebase
A maintenance fork of the Merc 2.2 MUD codebase, hardening and preserving the original game server — the lineage GodWars, and Ben, grew up on.
- 2013–2014
Dell SecureWorks · 7 developers
Senior Security Researcher, Team Lead
Led the engineering team supporting the Counter Threat Unit, one of the industry's pioneering threat intelligence groups.
Responsible for
- Product evaluations, architecture consulting, and workflow development.
- Cross-departmental initiatives on behalf of the research group.
Delivered
- Supported a threat intelligence group that operated like a startup inside the company.
- 2011–2013
Dell SecureWorks · Individual contributor
Security Researcher
Rapid prototyping and large-scale data work for threat research.
Responsible for
- ETL, malware analysis, data aggregation, systems architecture, and internal tooling.
Delivered
- Built an automated malware analysis system.
- Fully rewrote the internal CMS.
- 2008–2011
SecureWorks · Individual contributor
Operational Intelligence Engineer
Turning raw security telemetry into usable operational signal.
Responsible for
- ETL pipelines, analytics dashboards, and rule-based detection systems.
- IDS/IPS tuning and Snort rule authoring.
Delivered
- Built remote agent health monitoring behind a Java Web Start interface.
- 2006–2008
LURHQ · Individual contributor
Senior Security Analyst
Senior analyst work on a managed security services floor.
Responsible for
- Log analysis, regular-expression development, Snort tuning, and firewall configuration.
Delivered
- Developed the analysts who came after.
- 2005–2006
LURHQ · First role in the industry
Security Analyst
Where the career started: reading logs on a managed security services floor.
Responsible for
- Log analysis, regular-expression authoring, system administration, and remote agent configuration.
Delivered
- Co-developed TRUMAN, extending a bare-metal malware sandnet into an internal production system.
- 2005
TRUMAN
The Reusable Unknown Malware Analysis Net — a bare-metal malware sandnet. Joe Stewart authored the original proof of concept and holds public attribution for it; I co-developed the extension into an internal production system, writing the Perl orchestration, telemetry collection, and analysis workflows for a single-master, multiple-slave architecture. PXE-booted machines alternated between a Windows boot that ran the sample and a Linux boot that diffed the filesystem, with the master capturing packets. Because nothing was virtualised it defeated VM-detection evasion years before that was widely understood, and predated Cuckoo Sandbox by five.