I build practical web, automation, and AI-security systems — then I try to break them.
Full-stack + automation engineer and cybersecurity student (WGU — B.S. Cybersecurity & Information Assurance, in progress).
I ship working products, then stress-test them: prompt-injection defense, LLM evaluation, and multi-AI workflows on the build side; SOC labs, CTFs, and red-teaming on the break side. 🇺🇸 EN / 🇪🇸 ES.
🌐 davidtiz.com · 🧪 Razon Lab · 📫 hello@davidtiz.com · 💼 LinkedIn
A deployed prompt-injection detection scanner with a versioned rule set (v1.0.2) and named detections. Scores inputs by severity, surfaces detections, and passes lint / typecheck / test / build gates in CI. → Code · Live demo
A browser-first Mii pixel-art studio and breach-recovery guide hub, built with React/TypeScript and Cloudflare Workers, D1, R2, and KV. → Code · Live site
A live English/Spanish local-service website with service-area pages and a quote flow for a DeKalb County landscaping business. → Code · Live site
- 31-workflow automation library validated across n8n / Make / Zapier (31 valid, 0 invalid via an automated check).
- MAPS — a multi-AI orchestration system that routes work across models by input surface and cognitive role, with a context-integrity protocol and an honest "when not to orchestrate" decision framework.
- Dual-agent build pipeline where the author agent never approves its own code — shipped a tagged release.
- grok-mcp-server — a Model Context Protocol server for wiring Grok into agent workflows.
- Azure SOC & honeynet lab — deployed Microsoft Sentinel SIEM across 5 VMs, authored 20+ KQL detection queries, and visualized live attack telemetry on a geo attack map.
- 20+ CTF solves (National Cyber League, US Cyber Games) across forensics, web, reverse engineering, crypto, and privesc — with 12+ custom Python solvers and a verified pwntools exploit chain. → Notes
- 130+ confirmed model breaks across public AI red-team arenas (Gray Swan) — indirect prompt injection & safeguard bypass, each with a recorded submission ID; built a 5-tier prompt-injection defense taxonomy.
Languages · Python · TypeScript / JavaScript · Bash · SQL · PowerShell AI / LLM · RAG (pgvector) · evals & attack-success measurement · prompt-injection defense · Claude / GPT / Gemini / Grok · MCP · n8n / Make / Zapier Security · Microsoft Sentinel / KQL · Splunk · Burp Suite · Nmap · Wireshark · MITRE ATT&CK · pwntools · John / hashcat Cloud & Infra · Azure · AWS · GCP · Docker · Vercel · Cloudflare · DigitalOcean · Terraform
Earned — CompTIA Security+ · CompTIA Network+ · CompTIA A+ · Linux Essentials (LPI) · ITIL Foundation In progress — CompTIA CySA+ · ISC2 SSCP
Building practical web, automation, and AI-security systems, sharpening SOC and detection skills, and preparing evidence-qualified experiments for Razon Lab.
I think the interesting work in security is the glue between strong fundamentals and intelligent tooling — building useful systems, then hardening them.