Laurence Avent

• Own SIEM operations end-to-end on Rapid7 InsightIDR: custom detection rules, alert triage, incident-response workflows, and security metrics across the organisation.
• Configure and manage AWS security services at scale (GuardDuty threat detection, Security Hub posture management, and Lambda-based automated remediation), with secure-by-default patterns for engineering teams.
• Led response to an active Storm-1811 / Black Basta-style vishing campaign: identified the attack pattern, coordinated cross-team containment, and hardened the environment afterwards.
• Built internal MCP registry infrastructure (Terraform, CloudFront) for controlled adoption of AI-assisted development tools, and led the security evaluation for the GitHub Copilot Enterprise rollout: IAM controls, policy, and governance.
• Drive the SOC 2 compliance programme through Drata and coordinate third-party penetration-testing engagements.
• Embedded security advisor to product teams: design reviews, secure-coding practice, and business risk in plain language.

• Configured GCP Security Command Center and Cloud Armor WAF rules for OWASP Top 10 protection across the Google Cloud environment.
• Hardened multi-cloud storage integrations across Azure, GCP, and AWS: IAM policies, network configuration, and access controls.
• Owned controls and compliance for the company's first SOC 2 Type II.
• Managed inbound vulnerability disclosures from external researchers and drove remediation.
• Brought security requirements into design reviews and automated security testing into CI/CD.

• Founded the Security Incident Response Team: identified the organisational gap, made the business case, recruited the responders, and delivered an operational SIRT.
• Led the emergency response to Log4Shell (CVE-2021-44228), coordinating cross-team remediation across production services under time pressure.
• Discovered and remediated a WAF bypass through independent security testing.
• Deployed OpsGenie alerting and DataDog security monitoring; drove preventive improvements out of root-cause analysis.

• Technical support for 250+ enterprise customers on a security GRC platform comparable to Drata or Vanta.
• Influenced the product roadmap through structured customer feedback on security-workflow UX.
• Debugged complex issues across REST APIs, SSO/SAML, and role-based access control.

Paralegal work, data analysis and business intelligence, and enterprise customer operations. The grounding in regulatory detail, SQL, and stakeholder communication still informs the security work.

A Rust vulnerability scanner exposed as an MCP server for AI-agent orchestration. Models web applications as state graphs and uses constraint inference to discover and verify vulnerabilities across 52 classes; every finding is verified in a real browser with a full evidence chain. Scores 100% on Google's Firing Range benchmark (85/85 endpoints); real-world findings have been disclosed to Anthropic and Cloudflare. 267 MCP tools, 468K lines of Rust, 7,800+ tests.

A Rust reverse-engineering platform. Disassembles PE, ELF, and Mach-O binaries across four architectures, lifts to a 43-opcode IR, constructs SSA form, and decompiles to typed C. Concolic falsification removes false positives by constructing concrete exploit witnesses through SMT solving; hybrid fuzzing, taint analysis, and scanning across 14 CWE classes. 140 MCP tools, 2,800+ tests.

Critical systems analysis, decision-making under uncertainty, positioning systems, and maritime communications. The operational discipline of safety-critical environments still shapes how I approach security engineering.