Jeffrey David

Aspiring fraud, SOC and security analyst, bilingual in English and Spanish, with 4+ years of operations leadership in a heavily regulated industry, where I verified licenses and compliance paperwork for 100+ vendor brands and led teams of up to 26. I build open-source detection tools in my Guardian series, including ai-guardian, which finds the AI agents on a machine and flags what they can access, and php-guardian, shipped the day after a CISA critical-vulnerability alert. Open to fraud, SOC and security analyst roles, remote or Southern California.

• Free, local scanner that discovers the AI agents on a machine (AI apps, coding agents, browser extensions, local model servers, and MCP servers that connect agents to files and accounts) and maps what each one can access.
• Flags risky setups: API keys stored in plain text, agents with access to the whole drive or SSH keys, permission prompts turned off, unpinned or unencrypted MCP servers, and local AI servers exposed to the network.
• Brings the discover-and-map model of enterprise AI agent security (e.g. CrowdStrike Falcon Guardian) to individuals and small businesses. Read-only, with every secret masked in output.
• First scan of my own laptop found 16 AI agents; that real-world run exposed 3 bugs that synthetic tests missed, which I fixed and covered with regression tests (23 tests total).
• Project page: jeffreyesdavid.github.io/ai-guardian

• Built the day after CISA warned of "php2shell" (CVE-2026-109618 / CVE-2026-109619), critical PHP flaws allowing unauthenticated remote code execution.
• Automates CISA's first step, asset inventory: finds PHP installs in common hiding spots and flags vulnerable, patched, and end-of-life versions against the fixed releases.
• JSON output and exit codes so results can feed a SIEM, cron job, or CI pipeline. Read-only, with no exploit code; 16 boundary tests.
• Project page: jeffreyesdavid.github.io/php-guardian

• macOS tool that spots fake Wi-Fi before you join it: evil twins (same name, weaker security), unknown access points, look-alike names (homoglyphs, hidden characters, "FREE WiFi" bait), and router identity changes that point to ARP spoofing.
• Wrote a small Swift helper because macOS hides Wi-Fi names from apps without Location permission; 11 detection tests.
• Runnable attack demo uses a simulated network, so my real network name, router MAC, and location stay out of the public repo.

• Python command-line tool that checks a crypto transaction before it is signed and explains the risk in plain English.
• Try it live: txguard-jeffrey.streamlit.app, a web version anyone can use without installing anything.
• Matches every address in a transaction against 2,500+ known scam addresses from a public threat-intelligence list.
• Detects the most common wallet-draining tricks: unlimited token approvals, NFT "approve all," and permit signatures.
• Simulates the transaction on the live Ethereum network to show exact losses (e.g. "you lose 500 USDC") and surface approvals hidden inside other calls.
• Covered by 37 automated tests; validates malformed input instead of silently misreading it.

• macOS monitoring agent that checks every 30 seconds that a VPN is actually protecting the connection, and alerts the laptop and phone the moment it isn't.
• Detects VPN drops, IP leaks (the VPN reports "connected" but sites still see the real IP) and route leaks (traffic leaving outside the tunnel), plus Wi-Fi, DNS and location changes.
• Explains each alert in plain English with a local AI model through Ollama, so no data leaves the machine.
• Project site: jeffreyesdavid.github.io/vpn-guardian, with a live check of what websites can see about the visitor.

• Python tool that fingerprints music producers' beats, timestamps them on Bitcoin as proof of ownership, and finds them inside other songs, even under vocals, compression, or a sped-up disguise.
• Outputs a shareable evidence report; 10 end-to-end tests.

• Python script that checks passwords against the Have I Been Pwned breach database.
• Uses k-anonymity, so only a partial hash is sent and the real password never leaves the machine.

• Investigated a critical security alert on my own account: rotated credentials, audited active sessions, and checked for mailbox persistence.
• Documented the triage and remediation steps in a written incident report.
• Practiced credential hygiene: scoped a least-privilege access token to a single repository, then revoked and rotated it immediately after accidental exposure.

• Hired and led a team of 6 to ensure every product was packaged and labeled in line with state regulations.
• Provided direct operational support to the CEO, CFO, and Director of Cultivation on planning and oversight.
• Acted as liaison between the executive team and department managers to streamline workflows.
• Built the company's brand identity and social media presence from scratch ahead of a planned delivery launch.

• Handled every stage of commercial cultivation, from cloning and propagation to harvest.
• Monitored environmental controls and ran integrated pest management across a multi-room weekly harvest rotation.

• Promoted from Dispatcher to run all delivery and dispatch logistics for a high-volume operation.
• Vendor due diligence: verified licenses, Certificates of Analysis, and required paperwork for 100+ brands before their products reached customers.
• Scaled the active driver team from 16 to 26 while optimizing routes and performance.
• Oversaw daily inventory and secured exclusive brand partnerships.
• Contributed to the company winning the "Best of the Desert" award in 2021.

• Ran a vintage apparel business: sourcing, inventory management, pricing, and direct sales at pop-up markets.