James King.

Trace3, Senior Solutions Architect, Offensive Security and AI Security

January 2024 to present · Remote

• Lead offensive and AI security engagements for more than twenty enterprise clients across healthcare, insurance, pharmaceuticals, manufacturing, and financial services: agentic platform penetration tests, AI threat models, cloud posture assessments, web application and external tests, and threat hunts.
• Run Azure and Entra ID engagements end to end: tenant and identity enumeration, conditional access and token abuse paths, attack-path analysis, posture and benchmark assessment against CIS and CISA baselines, and threat hunts across Azure and Microsoft 365 telemetry. Microsoft Copilot Studio is the pilot platform for the insurer's review capability.
• Advise on Azure cloud security beyond the test: best-practice assessments against Microsoft and CIS baselines, and cloud security framework work that gives a client a standing basis for its own architecture decisions instead of a one-time finding list.
• Designed the practice's agentic threat-modeling method: a falsifiable claims ledger over a data-flow diagram, anchored on CSA MAESTRO with OWASP LLM Top 10, AISVS, and MITRE ATLAS mapped onto it, delivered as a review process clients run themselves after the engagement ends.
• Delivered an agentic AI penetration test of a production enterprise agent: validated exposure at the agent-to-tool, agent-to-agent, and user-content-to-instruction boundaries, with findings the engineering team could reproduce and close.
• Conduct MCP (Model Context Protocol) security assessments: credentialed tool-surface enumeration, prompt-injection and jailbreak execution, confused-deputy and token-passthrough testing, SSRF via tool, tool-schema poisoning, and human-in-the-loop bypass, each finding tied to a documented claim and its evidence.
• Co-authored and operationalized an enterprise AI safety and security standard for a global pharmaceutical company: risk classification, lifecycle controls, threat modeling, secure deployment, incident readiness, and emergency shutdown protocols for high-risk systems. Ran the AI-specific tabletop exercises and red-versus-blue scenarios that put it into practice.
• Built HackbotHarness, an agent-assisted penetration testing platform adopted into the practice's engineering organization: a deterministic scope gate on every tool call, human approval before any exploitation, and a severity-scaled evidence bar before a finding reaches a client report. Roughly 80,000 lines of TypeScript across 379 commits since April 2026, built to cover more attack surface per engagement without loosening the safety gates.
• Authored a vendor-agnostic MCP and agent-identity security reference and a library of seventeen engagement skill packages that turn methodology into repeatable, reviewable tooling across Azure, AWS, internal, external, web application, and agentic assessments, so a second consultant runs the same method at the same depth without retraining.
• Built the Azure infrastructure the offensive practice tests from: idempotent provisioning and cloud-init images for scanning and range roles, a dedicated egress identity, and a subscription guard that refuses to build outside the offensive security subscription, so engagements run from reproducible infrastructure instead of a consultant's laptop.
• Automated the path from scan output to client report: orchestration and parsing for network and vulnerability scanners, a finding importer that pushes reviewed markdown findings into the reporting platform, and evidence capture wired into the same pipeline, removing the hand copying that used to sit between testing and reporting.
• Turn assessment output into risk decisions rather than finding lists: every claim scored and sequenced by likelihood and business impact against the client's own architecture, with remediation owners, control gaps, and a register the client keeps running after the engagement ends.
• Led penetration tests across Azure, AWS, GCP, and OCI, plus external, web application, and OSINT engagements. Architected data security programs on DSPM tooling and cloud-native controls with remediation patterns clients could repeat without us.

STARS, LLC, Senior Security Architect

January 2021 to January 2024

• Owned security architecture and operations for a 900-user organization: framework-aligned controls, XDR with network security monitoring and packet analysis, and continuous threat hunting across endpoint, network, and Azure and Microsoft 365 telemetry, run as always-on penetration testing.
• Ran the organization's move to Azure end to end, then tested what was built: penetration testing of the new tenant and workloads, and best-practice analysis against Microsoft and CIS baselines, so the migration closed with the gaps found rather than assumed.
• Rolled out MFA everywhere, with single sign-on across 34 production applications, and founded the information governance committee covering data loss prevention, classification, and lifecycle.
• Ran the risk side of the program: cut critical vulnerabilities 80 percent in the first year with people-and-process-first vulnerability and attack-path management that sequenced work by exploitability and business impact instead of raw finding counts, with residual risk stated in terms leadership could accept or fund.
• Discovered critical zero-day vulnerabilities in vendor and in-house web applications and drove them to remediation.
• Rebuilt security awareness with automated phishing campaigns, recorded training, and regular staff touchpoints.

Rapid7, Penetration Tester

April 2020 to January 2021

• Lead consultant across the full engagement lifecycle: scoping, testing, reporting, and client debriefs.
• Developed novel attack and evasion techniques against multi-cloud environments and applied them on Azure and AWS compromise engagements and Azure security assessments, including Azure AD identity attack paths, with Cobalt Strike and Burp Suite.
• Delivered web application, internal Active Directory, and social engineering engagements (credential harvesting, MFA bypass, vishing), translating findings into defense-in-depth roadmaps clients acted on.

VDA Labs, Information Security Consultant

October 2018 to April 2020

• Executed full-scope penetration tests and led incident response for ransomware, business email compromise, and insider threat cases, including ransomware negotiations, with reports and briefings to executives and engineers.
• Senior staff augmentation for client security teams: designed and led CASB deployments and detection engineering programs, ran Azure security assessments, and advised on supply chain and cloud security.
• Built security metrics, benchmarking, and risk dashboards for client leadership, turning technical findings into a prioritized picture a board could act on; delivered conference talks and technical and user-awareness training.
• Integrated threat intelligence feeds and automated alert triage into client environments, cutting the manual analyst step out of the first pass and shortening time to detection.

Earlier roles

2017 to 2018

Security consulting at ITS Partners (threat hunting, EDR and endpoint encryption rollouts, on-site knowledge transfer), SOC analysis at Spectrum Health (vulnerability and threat queues, IAM, SIEM tuning, forensics coordination), and pre-sales engineering at Data Strategy.