SECURITY AUTOMATION & AI RISK GOVERNANCE · KRAKÓW, POLAND

Resilient security automation engineered to survive real-world faults.

Security automation engineer with 15+ years building fault-tolerant infrastructure, zero-touch operational pipelines, DLP policy enforcement, and autonomous AI risk controls across global environments. Seeking full-time senior security automation roles (consulting available for scoped engagements). Confident briefing corporate VPs, generals, and ministers on high-stakes technical breakdowns.

STATUS: Available immediately (no notice period)

LOCATION: Kraków, Poland

PREFERENCE: Remote · Open to EU-based hybrid arrangements

ENGAGEMENT: Prioritizing full-time senior roles; consulting available for scoped engagements

WORK AUTH: PL Permanent Residence (Karta Pobytu) · No sponsorship required for EU roles · Remote only / EU hybrid

250+

Lab Environments Managed

Across 23 countries globally

85%

Registration Time Cut

3 hours reduced to 15 minutes

~400h

Annual Overhead Eliminated

Zero-touch lifecycle automation

60%

Manual SOC Triage Saved

Tenable attack surface pipeline

CORE STACK: Python Linux Docker Ansible Cortex XSOAR Tenable ServiceNow DLP SOAR AI Risk Governance

Security Automation

DLP Pipeline Engineering

Attack Surface Management

AI Risk & Governance

Incident Response

Zero-Touch Lifecycle Automation

↓ Download CV (PDF) ✉ chad@failforward.dev LinkedIn Profile

⚡

Short on time? You're done.

The summary above is your complete 60-second recruiter overview: experience, impact metrics, tech stack, and direct contact links. No scrolling required.

🔬

Want the technical details?

Keep scrolling for production experience, security postmortems, AI safety framework, and architecture prototypes.

Go Deeper ↓

// PROVEN TRACK RECORD PRODUCTION

Engineering Experience

15+ years building security operations, automated enforcement pipelines, and robust infrastructure.

Security Automation & Enforcement Engineer

Motorola Solutions · Kraków, Poland · Dec 2024 to Apr 2026

Accountable for security automation, endpoint enforcement, threat intelligence operations, and attack surface discovery across 250+ product lab environments in 23 countries. Built the six-phase LabSecurity Evolution Program from scratch.

Lab Lifecycle Automation: Designed end-to-end pipeline (intake, provisioning, validation, governance, monitoring, decommission) cutting registration time by 85% and eliminating ~400 staff hours of annual manual effort.
DLP Enforcement Pipeline: Built policy-driven DLP evaluation in Cortex XSOAR with conditional routing, Human-in-the-Loop high-risk escalations, and automated audit logging.
Threat Intelligence & Asset Tracking: Integrated Google Threat Intelligence with ServiceNow CMDB for real-time asset attestation and attack surface tracking.
Attack Surface & Tenable Scanning: Orchestrated automated vulnerability assessment workflows, reducing manual SOC triage overhead by ~60%.
Proactive Security Discovery: Uncovered unrestricted Artifactory ISO access paths, Mac App Store migration security flaws, and DLP bypass vulnerabilities in unmanaged AI endpoints.

Technical Support & Systems Lead

Motorola Solutions · Kraków, Poland · 2018 to Dec 2024

Directed mission-critical RF communications and application server infrastructure for public safety and enterprise clients across 50+ countries.

Orchestrated real-time incident response and resolution for government and enterprise clients during live blue-light incidents.
Built internal tooling to automate case tracking, prioritization, and ticket escalation routing.
Managed full defect lifecycle from detection through zero-downtime patch deployments on live public safety systems.

L2/L3 Product Specialist & Technical Lead

GFI Software / Aurea · Malta · 2011 to 2018

Global technical lead and product lifecycle owner for enterprise security products.

GFI LanGuard: 7-year technical lead for enterprise vulnerability scanning and patch management covering Windows, macOS, Linux, and 80+ third-party applications. Highest internal authority on scanning engine behaviors and OVAL compliance.
GFI EndPoint Security: 7-year technical lead for endpoint DLP and device access control (USB, Bluetooth, optical media) with Content Awareness scanning and AES-256 encryption enforcement.

Lead IT Administrator & Field Service Engineer

Cargo Security Management / Sterling Global · Iraq & Afghanistan · 2007 to 2010

Deployed and maintained VSAT satellite communications and network infrastructure across 7 critical field installations with 100% uptime in austere operating conditions. Engineered bare-metal Windows Server and Cisco/Fortinet/F5 environments.

// INCIDENT ANALYSIS & LESSONS

PRODUCTION

Security Postmortems & Discoveries

Dissecting real architectural vulnerabilities, root cause mechanics, and engineering preventions.

SEV-1 API Security INC-2024-11

The Zombie Staging Gateway Leaking 40,000 Auth Tokens

An unlisted legacy staging API gateway remained accessible on edge routers 18 months post-DNS migration, routing unauthenticated production traffic with permissive mTLS certs.

BLAST RADIUS: 40,000 active service session tokens exposed to internal subnets; 14 orphaned endpoints discovered with full CRUD access to legacy billing tables.

ROOT CAUSE: Decommissioning ticket was closed when DNS cutover finished, but edge reverse-proxy routes were never pruned from Terraform state.

FIX & PIPELINE: Deployed automated API discovery against edge netflow telemetry; built an automated pipeline that kills DNS records if an endpoint fails weekly heartbeat telemetry validation.

SEV-1 API Security INC-2025-01

BOLA / IDOR on Internal Fleet Telemetry API

A diagnostic microservice built for lab hardware allowed any authenticated internal service token to execute remote diagnostic shell commands on arbitrary hardware nodes.

BLAST RADIUS: 250+ lab environments across 23 countries vulnerable to remote script execution by any internal microservice token.

ROOT CAUSE: Developers relied on perimeter network segmentation rather than object-level authorization (BOLA) checks inside the service controller.

FIX & PIPELINE: Enforced zero-trust RBAC at Envoy mesh ingress; integrated automated BOLA contract assertions into CI testing before pull request merge.

SEV-2 DLP & Privacy INC-2025-03

The 14,000-Block False Positive Regex Storm

An un-staged DLP regex update designed to detect proprietary cryptographic salt keys collided with base64 strings generated by Git commit hashes and build artifacts.

BLAST RADIUS: 14,000 developer push events and CI pipeline triggers blocked over 36 hours across 4 global engineering hubs.

ROOT CAUSE: A raw regex pattern was pushed directly to the central enforcement engine without staging or backtesting against historical git traffic.

FIX & PIPELINE: Engineered a canary staging pipeline for all DLP signatures that replays 30 days of historical developer traffic through a shadow engine before global deployment.

SEV-1 DLP & Privacy INC-2025-06

Inverted Regex Mirroring Sanitized Dumps to Public S3

A developer data scrubbing utility intended to redact customer PII before lab testing inverted an exclusion regex flag, stripping benign fields while preserving raw credentials and PII.

BLAST RADIUS: 120,000 customer test records staged in non-production environments with live PII intact.

ROOT CAUSE: Lack of automated schema validation and entropy assertions on transformed outputs prior to bucket upload.

FIX & PIPELINE: Deployed pre-commit payload validation with strict entropy checks; automated instant bucket revocation if raw PII hashes are detected.

SEV-1 Patch Ops INC-2024-09

Emergency Zero-Day Patch Triggered Global PAM Lockout

An out-of-band OpenSSH security update pushed to 120 edge Linux servers overwrote custom PAM configurations, terminating administrative SSH access across the fleet.

BLAST RADIUS: Complete loss of remote console management on 120 production nodes in 8 data centers, requiring out-of-band serial recovery.

ROOT CAUSE: Upstream distribution package update replaced configuration files without checking local PAM include overrides.

FIX & PIPELINE: Authored immutable Ansible deployment playbooks with pre-flight configuration diff assertions; enforced automated snapshot rollback on all edge hypervisors.

SEV-2 Patch Ops INC-2024-12

The Uncoordinated Log4j Kernel Reboot Storm

An automated emergency remediation script rebooted application nodes simultaneously rather than in rolling batches, causing split-brain cluster desynchronization.

BLAST RADIUS: 18 hours of telemetry blind spots across 250+ environments while the state store struggled to recover quorum.

ROOT CAUSE: Panic patching without concurrency limits (max_parallel: 1) configured in the automation orchestrator.

FIX & PIPELINE: Hard-coded global concurrency limits and mandatory canary node health-checks into all emergency patching runbooks.

SEV-1 Access Control INC-2025-04

Unrestricted Artifactory ISO Access Path

Identified unauthenticated read permissions exposing production OS images and builds without access logging or audit tracking.

BLAST RADIUS: Global build repositories accessible to unauthenticated subnet requests.

ROOT CAUSE: Default anonymous read permissions remained active after repository migration.

FIX & PIPELINE: Enacted immediate RBAC lockdown, revoked anonymous access, and deployed automated audit alarms.

SEV-2 AI / DLP INC-2025-08

DLP Policy Evasion in Consumer AI Workflows

Discovered browser-based consumer AI tooling bypassing local device trust and scorecard controls.

BLAST RADIUS: Potential exfiltration of internal code snippets to unvetted third-party LLM providers.

ROOT CAUSE: Standard browser extensions lacked endpoint DLP inspection hooks for WebSocket and streaming SSE payloads.

FIX & PIPELINE: Engineered proxy-level inspection rules and automated DLP detection pipelines in Cortex XSOAR.

SEV-2 Device Trust INC-2025-11

Device Trust Enrollment Gap on Web Services

Identified cloud note-taking and productivity services operating outside corporate MDM compliance rings.

BLAST RADIUS: Unmanaged personal devices able to sync sensitive internal architecture documentation.

ROOT CAUSE: SSO policy missed mandatory device-posture certificate validation on third-party SaaS endpoints.

FIX & PIPELINE: Authored automated attestation checks to enforce conditional access policies before token issuance.

SEV-3 Automation INC-2026-02

IPAM Desynchronization During Lab Teardown

Rapid decommissioning left orphaned DNS and IP reservations in legacy IPAM records.

BLAST RADIUS: IP collision warnings and delayed subnet allocation during rapid lab reprovisioning cycles.

ROOT CAUSE: Asynchronous teardown jobs failed silently on IPAM API timeout without retry logic.

FIX & PIPELINE: Redesigned teardown orchestrator to execute atomic cleanup across ServiceNow, IPAM, and cloud storage with idempotent validation.

// FLAGSHIP FRAMEWORK FRAMEWORK · IN DEVELOPMENT

AI Warning Labels & Safety Disclosure

I have been working to create an operational hazard communication framework adapting GHS chemical safety standards and FDA nutritional facts to artificial intelligence systems, foundation models, and autonomous agents. I would very much like to find someone to help me push this forward on a global scale as a standard. If anyone has recommendations or someone I should contact, please reach out to me.

// THE ORIGIN: WHY HAZARD LABELS FOR AI?

The Problem: AI safety discourse is polarized between abstract existential doom papers and toothless corporate marketing statements. When engineers, SOC analysts, or enterprise users interact with foundation models or autonomous agents, they receive zero actionable, standardized telemetry regarding specific failure modes, cognitive biases, or operational bounds.

The Industrial Metaphor: In chemical hazard management, nobody reads a 40-page dissertation before handling an industrial solvent. Operators rely on GHS (Globally Harmonized System) standardized pictograms and signal words (DANGER, WARNING) paired with specific precaution codes. Consumers rely on FDA Nutrition Facts to instantly inspect sodium and trans fats.

The Framework: This system adapts GHS hazard diamonds, ISO 7010 caution triangles, and transport placards into an operational visual safety taxonomy for AI systems.

From Confabulation Hazards (AI-H201) to Agreement Bias / Sycophancy (AI-W110) and Human Oversight Mandates (AI-M401), the framework converts ambiguous AI risk into enforceable visual disclosures that compliance and security operations teams can audit.

01. HAZARD PICTOGRAMS (CLICK TO INSPECT)

Confabulation Hazard AI-H201

May generate fluent, confident falsehoods indistinguishable from fact.

PRECAUTION: Verify all factual claims against primary sources before action.

Source Reference: GHS07, exclamation mark

02. MODEL NUTRITION FACTS

System Facts

Standardized Safety & Provenance Metrics

Model Architecture: Frontier LLM (>10^25 FLOP)
Training Data Disclosed: Partial
Eval Benchmark Coverage: 74%
Human Oversight Model: Available
Explainability Rating: Low
Third-Party Bias Audit: Conditional

Risk Profile: Moderate / Amber

03. TRANSPORT & CERTS

DEPLOYMENT RISK

// PROTOTYPE ARCHITECTURE PROTOTYPE · SYNTHETIC DATA

API Governance & Shadow AI Discovery

I have designed an automated continuous discovery pipeline mapping unapproved LLM endpoints, detecting schema drift, attributing host/engineer ownership across business units, and enforcing multi-tier governance escalation. This is a sample with dummy AI-generated data.

1,420

Active Endpoints Polled

Shadow AI Services Mapped

Unregistered Owners Identified

100%

Zero-Touch Quarantine

ESCALATION PROTOCOL

Rogue API Governance & Permissions Hierarchy

When passive eBPF sensors or schema drift diffing detect an unregistered or shadow AI endpoint, ownership is mapped via commit history, subnet lease, and service token metadata. Governance follows a strict 4-tier chain of custody:

LEVEL 01 · 24H SLA

Direct Engineering Manager

Attestation & Triage

Automated webhook dispatches telemetry to the attributed author's direct manager. Manager must attest business justification, link an active Jira ticket, and submit an OpenAPI contract schema.

LEVEL 02 · 48H SLA

Business Unit Owner (Director)

Scope & Compliance Review

If unattested within 24 hours or flagged for high data egress, escalates to the BU Director. BU Owner reviews data classification, decides on corporate licensing, or mandates migration to approved relays.

LEVEL 03 · 72H SLA

Vice President (VP)

Executive Risk Acceptance

Mandatory exception gate for frontier models or external cloud endpoints bypassing corporate proxy inspection. Requires signed VP risk acceptance acknowledging data residency and retention risks.

LEVEL 04 · ZERO-TOUCH

Central IT / SecOps (SOAR)

Automated Quarantine

If SLA timers expire without sign-off or if active DLP policy violations (API keys, PII, source code) are confirmed, automated SOAR playbooks isolate the host, revoke edge routing, and sinkhole DNS.

01 Passive eBPF Taps

Kernel level netflow telemetry continuously identifies unlisted external LLM connections, socket bindings, and raw auth tokens.

02 Author & Subnet Attribution

Correlates netflow socket PIDs with K8s service accounts, Git commit authors, and DHCP subnet leases to pinpoint exact owners.

03 DLP & Schema Drift Diff

High-entropy payload scanners inspect buffers against OpenAPI contracts to detect proprietary code, customer PII, and undeclared routes.

04 Multi-Tier Escalation

Routes alerts through Manager -> BU Owner -> VP -> SecOps hierarchy, triggering zero-touch quarantine upon SLA expiry.

DEMO · SIMULATED TELEMETRY STREAM (SYNTHETIC DATA)

SYNC: 100ms

[12:56:02.140] [BLOCKED] POST api.openai.com/v1/chat/completions : Matched DLP Rule 802 (API Secret Key Pattern) from host 10.24.12.8 (Attributed: demo.user@example.corp)

[12:56:01.890] [ALLOWED] POST generativelanguage.googleapis.com/v1beta : Corporate Contract Verified · Zero Retention Active · Data Science Unit

[12:55:58.412] [QUARANTINE] GET unverified-proxy.internal.corp/llm : Rogue reverse proxy detected · Zero OAuth token · Host 10.88.4.19 isolated by SecOps

[12:55:54.004] [DRIFT] POST api-stage-internal.legacy.net/v2/telemetry : Undocumented schema field 'session_token' · Escalated to BU Owner

[12:55:50.220] [ALLOWED] POST api.anthropic.com/v1/messages : Engineering workspace bound · Contract Zero Data Retention verified

Target Endpoint & Method	Classification	Business Unit & Attributed Owner	DLP / Drift Trigger	Escalation Hierarchy State	Action

// ENGAGEMENT & HIRING

Hiring & Engagement

Primarily seeking full-time senior security automation roles. Also available for targeted consulting engagements (AI risk governance, DLP pipelines, SOAR automation).

Reach Out Directly

✉ Email chad@failforward.dev in LinkedIn chadcybersec

Prefer a detailed brief? Use the form below.

FULL NAME *

WORK EMAIL *

COMPANY / ORGANIZATION

ENGAGEMENT TYPE *

PROJECT SCOPE OR ROLE OVERVIEW *

EXPECTED TIMELINE

BUDGET RANGE (CONSULTING EUR)

Zero-tracker intake. Submissions are delivered directly to Chad Longanecker. No marketing third parties.