I work on systems-level security: compiler and program analysis, Linux systems administration, and a growing focus on reverse engineering. Based in Chandler, AZ.
My background spans military systems security and embedded systems: six years as an Information Systems Security Officer (ISSO) in the Arizona Air National Guard (AZANG) Cyber, running security authorization and compliance governance (NIST 800-53, ATO packages, POA&M management) for mission-critical systems; an ASU capstone hardening a device tree at the bootloader stage; and an M.Sc. thesis extending that into compiler-level vulnerability detection. The throughline is systems-level security work close to the hardware, not application-layer security.
My M.Sc. thesis is a Clang-Tidy static analysis tool that catches trust-boundary information leakage in C/C++: programs that are syntactically correct and free of undefined behavior, but still leak sensitive data across a trust boundary through object representation and struct padding, a class of bug conventional scanners miss entirely. It draws on some formal-methods groundwork underneath, but the tool itself is the point: evaluated on real-world C libraries with zero false positives.
Current work is split across two systems projects. camarena-arch-setup (v1.0) is a staged, idempotent install pipeline that reproduces my full Hyprland desktop environment on any fresh Arch install, official repos and source builds only, no AUR anywhere in the install path. Alongside it, I'm running a home-network VPN/Pi-hole project: a dedicated access point handling WireGuard tunneling and network-wide DNS filtering, isolating specific device traffic through chosen VPN endpoints without touching the primary mesh network.
Longer-term, and out of personal interest, I tinker on Project Datum: an attempt to make the Linux gaming graphics stack measurable and reproducible. Today, when a frame is late, the cause is buried across game, translation layer, driver, kernel, and compositor, with no unified view across the boundary. This is a personal project, not career-directed: I'm early, working through Vulkan fundamentals and reading the source of MangoHud and Gamescope as time allows.
A dedicated Arch Linux box set up as a wireless access point that routes selected device traffic through specific WireGuard VPN endpoints, with Pi-hole providing network-wide DNS filtering, all without altering the existing mesh network's routing or DNS.
A staged, idempotent install pipeline that reproduces a full custom Hyprland desktop environment on any fresh Arch install: window manager, Quickshell-based UI, theming pipeline, and system services, all from official repos, source builds, or GitHub release tarballs, with no AUR helper anywhere in the install path.
The Linux gaming graphics stack is a tower of opaque, interacting layers: game binary, translation layer, Vulkan, userspace driver, kernel graphics subsystem, compositor. When a frame is late, no single tool sees why. Project Datum is a personal exploration into a measurement substrate for cross-layer frame causality, pursued out of interest rather than as career-directed work.
Formalized trust-boundary information leakage as a confidentiality invariant violation over compiler-visible ABI semantics. Programs can be syntactically correct, undefined-behavior free, and still violate system-level security invariants through object representation and padding behavior, a semantic class the type system cannot enforce.
Bootloader-stage mechanism to selectively disable hardware devices in the Linux device tree on a secure mobile platform, reducing attack surface before userspace initialization. A hardware-software boundary security problem: enforcing a source-level security policy across cross-compilation toolchains, U-Boot, and embedded Linux internals.
Day-to-day sysadmin for a self-managed home network and desktop environment: a dedicated access point handling WireGuard tunneling and Pi-hole DNS filtering, a staged and idempotent Arch Linux provisioning pipeline (camarena-arch-setup, v1.0), and an ongoing personal-interest project measuring the Linux graphics stack. Full details in Projects below.
Built a formal model of trust-boundary information leakage grounded in C/C++ object representation semantics and ABI layout behavior. Implemented a complete Clang-Tidy static analysis module with CodeChecker integration, evaluated on open-source C libraries with manual validation of all emitted diagnostics. Zero false positives in real-world findings.
Built a bootloader-stage device-tree hardening mechanism for a secure mobile platform, reducing hardware attack surface before userspace initialization. Worked across cross-compilation toolchains, U-Boot, and embedded Linux internals; direct exposure to the semantic gap between source-level security policy and deployed binary behavior on real hardware.
Six years executing security authorization and compliance for mission-critical operational systems. NIST 800-53 controls, ATO packages, POA&M management, and incident coordination. TEMPEST enforcement per AFMANs, controlling electromagnetic emanation risks from hardware systems. COMSEC management including KMI operations and cryptographic material accountability.
I'm actively looking for security engineering, systems administration, and cyber
governance roles, based in Chandler, AZ or remote. My background
is built on military systems security and embedded systems, with current work in
Linux systems administration and a growing focus on reverse engineering.
If you're working on problems in systems security, Linux infrastructure, or reverse
engineering, I'd genuinely love to talk.