Automation for AppSec at AWS (Part 2)

Context Is Infrastructure

In Part 1, I described how the SHINE team at AWS evolved from deterministic automations to CDK Blueprint Property Injection to the Agentic Security Engineer. I ended on a line that deserves more unpacking: context is everything. That was true, but I glossed over how hard it was to actually assemble that context, and how much of our engineering time went into solving that problem before ASE could do anything useful. This post is about that context assembly problem, and the data pipeline we built...

Hobocon 2 – Electromotive Boogaloo

KC to CHI on an Amtrak Full of Hackers

This weekend, my buddy Mike Kunz and I drove from Omaha to Kansas City on July 17th to board a train. Not to go anywhere in particular. To attend a conference. A conference on a train! Hobocon is a cybersecurity conference that runs on an Amtrak train from Kansas City to Chicago with 68 people packed into a single regional car. The groups represented read like a regional hacker map: Iowa (SecDSM), Chicago (Burbsec), Omaha (DEF CON 402), Kansas City (SecKC) and even a group from the Washington DC...

Write Claude Skills. Don't Depend on Them.

Why Skill Repos Struggle Where SaaS Succeeds

There is a pattern in security automation that repeats itself. Someone writes a smart script or skill that does something valuable, puts it in a shared repo, and schedules it to run daily. Other people see it, write their own, commit them alongside the first one. The repo grows. The automations run. Then something breaks: an endpoint changes, a library gets deprecated, a permission gets rotated. And suddenly no one knows who owns it. I lived this at AWS. The scripts were Python, they were large,...

AI-Driven Development (AIDD) Without the Hype

What Actually Changes When AI Writes More of Your Code

This post is something I wish someone had spelled out when I was getting my hands dirty again; how to do AI-Driven Development (AIDD) in a way that actually holds up. I’d recently moved back to an individual contributor role after several years as a technical manager, and the day-to-day of writing and reviewing code had shifted more than I’d fully absorbed as a leader. Completion, prompts, and agentic flows aren’t additive tweaks; they change where effort goes and where the risks show up. AIDD...

Why I Joined Pixee

And How We're Building the Future of AI-Powered Application Security

After nearly four years at AWS, I made the decision to leave in early December and join Pixee as a Distinguished Engineer, focusing on AI Security. I didn’t take it lightly. I’m grateful for the people and problems at AWS, but I’m even more excited about what’s next. Hanging Up Their Shoes You can’t scroll LinkedIn right now without seeing this image of the Amazon smile and shoes. It’s people hanging up their shoes at Amazon (aka people leaving). Last week, on January 28th, the company laid off...

Automation for AppSec at AWS (Part 1)

Automation Before the AI

My time at AWS was spent working on application security at scale, most of that time building and leading the SHINE team (Security Hub of Innovation and Efficiency). Our mission to accelerate AppSec for builders, was straightforward and meaningful. We wanted security to enable shipping, not block it. That mission led us into some of the most interesting work I’ve been part of: automation, secure-by-default platforms, and eventually an AI-powered security engineer that could run reviews...

Rooting My Eight Sleep Pod 3

I’ve been using an Eight Sleep Pod 3 for a while now, and while I love the autopilot temperature control and sleep tracking features, I’ve always been frustrated by the cloud dependency. What happens if the internet goes down? What if Eight Sleep’s servers have an outage? More importantly, why should my local device need to phone home just to adjust the temperature? Those questions became painfully real on October 20th, 2025, when AWS us-east-1 went down. I woke up in the middle of the night,...

BruCON 2025 – Beer, Waffles, and a Product Review Cabal

My Conference Review

I spent a couple of excellent days at BruCON in Belgium. It’s a conference that blends deep technical content with a relaxed friendly hacker vibe all fueled by local Belgium beer, Club Mate and waffles. My wife and I turned the trip into a broader European vacation, with stops in France, the Netherlands, and Luxembourg, but I want to focus this post on BruCON itself - and why it should be on your list of conferences to attend. Getting to BruCON First, I have to give a big shoutout to Rita, our...

SHINE at AWS

When AI Outpaced Security

I joined Amazon Web Services (AWS) in June 2022 as an Application Security Manager. My team was comprised of 11 high-judgment security engineers tasked with holding or raising the security bar of services across Amazon. We covered services like Amazon-produced open source, Infrastructure-as-Code (IaC), AWS Console, and most relevant to my current role the Next-Gen Developer Experience (NGDE) organization. As NDGE ramped up experimentation with Generative AI, standard security reviews couldn’t...

Hello World

The Sequel

Welcome. This is my second attempt at creating and maintaining a blog. My first go at blogging was way back when I was trying to break into the cybersecurity field. Like so many in our field, I had a wonky career path before infosec and I wanted to find a way to prove that I knew what I was doing. Early career Originally, I worked as a structural engineer out of college. I went to the University of Nebraska Omaha, home of one of the three universities (at the time) to have an accelerated...