New York City security researcher working across vulnerability reproduction, AppSec, systems security, and authorized testing. I came to security through healthcare IT, systems administration, and embryology. That background taught me to check the evidence, record exactly what happened, and account for production impact.
I work from the attacker side in authorized labs and assessments, then turn the result into remediation and detection guidance another analyst can verify.
My current work centers on reproducing unexpected behavior, tracing it to the smallest defensible root cause, and building regression coverage around the fix. Recent work spans C and Go systems projects, sandbox hardening, detection content, an authorized AI/LMS assessment, and a five-person Linux vulnerability assessment.
My open-source work includes merged fixes in libavif, liburing, libcap, OWASP Nettacker, Atomic Red Team, Nuclei Templates, SigmaHQ, Splunk Security Content, and ActionScope. I like focused security-logic problems where a small change improves the accuracy or safety of a tool people already use.
| Area | Evidence |
|---|---|
| Decoder state safety | Two merged libavif fixes: PR #3327 added regression coverage for stale Sample Transform state, and PR #3333 completed the reset invariant |
| Kernel interface behavior | liburing PR #1628, reproduced an unsupported registered-wait path and moved the feature check before pending work could be published, merged |
| Linux capabilities | libcap commit e435fc5, corrected a Go file-capability encoding invariant with focused tests, merged |
| Sandbox hardening | nsjail PR #299, closes a parent-death-signal setup race with a deterministic differential probe, under review |
| Filesystem permissions | libzip PR #561, preserves POSIX ACLs across archive replacement with regression and sanitizer validation, under review |
| OWASP project | Nettacker PR #1659, synchronized 59 missing Russian locale messages and preserved every format placeholder, merged |
| Detection and emulation | Merged fixes across Atomic Red Team, SigmaHQ, Splunk Security Content, and Nuclei Templates |
| Published tool | STIGPilot on PyPI with public source |
| Portfolio | srkyn.com with work archive, case studies, local browser lab, changelog, and security contact file |
| Project | Focus | Artifact |
|---|---|---|
| Directory Fieldbook | Active Directory attack paths built, tested, remediated, and retested in an isolated VMware lab | Case 001 |
| Kioptrix Vulnerability Assessment | Sanitized assessment with 24 findings and a validated path from unauthenticated access to root | Case study |
| Authorized AI/LMS Security Assessment | Sanitized case study from an authorized 16-finding assessment of access boundaries, tool behavior, memory, evidence handling, and redaction controls | Control matrix |
| NGINX Map Risk Audit | Source-backed exposure review with a configuration heuristic, patch validation, and Splunk and Defender hunting notes | Repository |
| KEV Prioritization Notes | Public exploited-vulnerability triage using CISA KEV data and documented prioritization criteria | Repository |
| STIGPilot | DISA STIG change triage, remediation backlog generation, evidence checklist planning, and ticket-ready exports | Chrome demo |
| Splunk Detection Content | SPL detections mapped to MITRE ATT&CK with analyst pivots, tuning notes, and triage playbooks | Playbooks |
| IdentityRiskGraph | CloudTrail IAM investigation with nested access paths, MITRE-mapped findings, and reviewable risk context | CloudTrail detector |
| OPNsense + Proxmox Security Control Plane | Firewall intent, DNSSEC, Quad9 DNS-over-TLS, CrowdSec, Proxmox LXCs, VictoriaLogs, NetAlertX, OpenCanary, live threat telemetry | Architecture |
TryHackMe: top 1% public profile, 120+ completed rooms across web security, Linux, network analysis, SOC alert triage, SIEM, Splunk, EDR, and CTF-style problem solving.
Affiliations: OWASP Foundation Individual Member · ISC2 Member
Website: srkyn.com · Email: david [at] srkyn.com · LinkedIn: linkedin.com/in/srkyn
David Sarkisyan · Security Research · Vulnerability Assessment · New York City