Product Security Architect · AI-Native Security · Toronto

I find the attack surface, then design it away.

Product security architect with an offensive background. Threat modeling, secure design, and attack surface reduction, plus the AI-native workflows that make it scale. I built Eidolon, an open-source security agent orchestrator, and I lead Canada's largest hacker community.

120+
Validated vulnerabilities
6+
Years in security
20+
Enterprise clients tested
10+
Conference talks
What I Do

I'm a product security architect with an offensive background. My job is to threat model a design before it ships, find where the real attack surface is, and drive the architectural change that removes it, not to file a finding and move on.

I build the AI-native side of this too. I use Claude and OpenAI as core tools for threat analysis, abuse-case generation, and code review, and I wrote Eidolon, an open-source orchestrator that runs offensive security workflows with an AI agent in the loop, with real guardrails because an agent with real access needs them. I also run an offensive AI security workshop on attacking and defending agent-based systems.

The offensive grounding is real: 120+ validated vulnerabilities through HackerOne across web, API, cloud, and identity systems. Earlier, as a lead security architect, I built a company's security standards, detection, and architecture from scratch as it scaled. I lead DEF CON Toronto (DC416) and speak at SecTor and DEF CON Vancouver.

How I Work
01

Model the design, not just the build

A trust boundary drawn wrong on a whiteboard costs an afternoon. The same mistake in production costs a quarter. I model abuse cases with the engineers who wrote the doc.

02

Tune the tooling, don't just install it

A scanner at default settings buries a team in noise until they stop reading it, which is worse than nothing. I'd rather ship five findings a week that are all real than five hundred that aren't.

03

One bug, or a bug class

Findings get traced to root cause, then checked for the same pattern everywhere else. One IDOR is a bug. The same authorization mistake in nine places is a design problem.

Where I've Worked
White Tuque, Offensive Security Specialist
Toronto · Oct 2024 to Present
Threat model and run secure design and architecture reviews across web, API, cloud, and endpoint systems for 20+ enterprise clients, driving architectural changes that eliminate attack surface. Build AI-native security workflows using Claude and OpenAI for threat analysis, abuse-case generation, and code review. Owned and built a red team program from zero and designed deception into a client's architecture. Push engineering toward secure-by-default rather than blocking releases.
ASEC, Penetration Tester
Toronto · May 2024 to Oct 2024
Application security assessments for fintech and financial services clients across Canada, the US, Australia, and Europe, under Nick Aleks, former Senior Director of Security at Wealthsimple and now Head of Security at Robinhood. 150+ vulnerabilities across web, REST and GraphQL APIs, and cloud infrastructure.
Ofogh Kourosh Chain Stores, Lead Security Architect
Tehran · 2023 to Feb 2024
Built the company's first detection and response capability and its incident response playbooks and CSIRP from the ground up, defining the response procedures the organization ran against. Set the security design and standards new systems shipped against as the chain scaled from roughly 200 to 1,000 stores, building defense-in-depth into the architecture.
Ofogh Kourosh Chain Stores, Security Engineer
Tehran · Sep 2021 to 2023
Ran centralized logging, monitoring, and vulnerability scanning across a growing multi-site estate, and wrote detection and automation tooling in Python and Bash. Built network segmentation, hardening baselines, and identity and access management at scale, and introduced security checks into the software delivery process.
Ofogh Kourosh Chain Stores, Security Analyst
Tehran · Jun 2020 to Sep 2021
As the primary security resource, served as incident commander on live incidents across corporate and store infrastructure, from detection and triage through containment and lessons learned. Investigated and responded to malware, phishing, and account compromise, with remediation tracked to closure.
DEF CON Toronto (DC416), Lead Organizer
Toronto · 2025 to Present
Lead Canada's largest hacker community: monthly meetups, speaker programming, sponsorships, and events including the AI Fight Club workshop hosted at Palo Alto Networks. Also on the organizing committee for TASK, Toronto's longest-running security community.
HackerOne, Security Researcher
Remote · Feb 2022 to Present
120+ validated vulnerabilities across Fortune 500 disclosure programs. Focus on authentication and authorization bypass, privilege escalation, and multi-step business logic chains across web and API surfaces.
Projects & Research

Eidolon — AI-native security orchestrator

Open source (MIT), built and maintained in Python. It runs offensive security workflows with an AI agent in the loop, with per-engagement isolation, scope tokens, a hash-chained audit log, and three-tier command gating, because an agent with real access needs real guardrails.  github.com/amir-hosseinpour/eidolon →

Ecovacs Deebot teardown

Hardware and firmware security research under the vendor's bug bounty program. UART console access, firmware extraction, then up through the cloud API and mobile app.

Offensive tooling

Burp Suite extension for automated OAuth2.0 and OIDC authorization-bypass detection, and a Nuclei template library for API and application vulnerability discovery.

Get in touch

Happy to talk whenever works for you.

amir.m.hosseinpour@gmail.com HackerOne profile GitHub