I’m Ivan Rodriguez, a security engineer. I’ve been at Amazon since 2022; before that I was at Google, and earlier at Shopify.

Since late 2024, as AI-driven security automation has become core to security engineering rather than a specialty lane, I design local and cloud systems, deployed on AWS with CDK, that combine GenAI agents with deterministic tooling to catch and fix issues at every stage of development, from the first code change through to production.

That means using GenAI to enrich what those systems find: attributing a finding to its root cause, generating fix guidance, and verifying that a proposed fix actually resolves the issue. It means building the implementation loops that shorten the distance between finding a problem and shipping a verified fix. And it means the evaluation harnesses that keep the agents in that pipeline honest: benchmark suites and golden datasets with adversarial and failure-recovery cases, deterministic validators, automated and human-in-the-loop graders with calibration checks, and scorecards that weigh quality against risk, latency, cost, and human review effort, feeding back from production so we notice when an evaluator drifts away from reality. Beyond my own work, I share what I’ve learned building with AI and building AI systems across teams.

Before this, I spent about twelve years in mobile application security, and before that I was an iOS developer; in all, more than twenty years of building software. At Google, I took the Google Fi VPN for iOS from a proof of concept I built on my own initiative to public launch, designing and building the implementation with two engineers from a partner team. I wrote the free course Reverse Engineering iOS Applications, reported vulnerabilities in production apps through bug bounty programs, and spoke at QCon San Francisco and OWASP Toronto. In 2026 I combined both halves of that background into MobHunt, an open-source agentic mobile bug bounty system with strict validation gates. On real programs it produced 9 reports, 2 accepted and paid, 7 pushed back as “static analysis only.”

Interested in evaluation of AI agents, application security, reverse engineering, and applied cryptography. I keep a deliberately small footprint online, and this site collects nothing about you.

Views expressed here are my own.