Security Engineer · Security Researcher · Applied Scientist · PhD Candidate · Stony Brook University
Cloud-native security research — detecting and preventing sensitive-data leakage from serverless platforms to Kubernetes clusters.
About
I am a Security Engineer, Researcher, and Applied Scientist completing a PhD in Computer Science at Stony Brook University, advised by Dr. Michalis Polychronakis. I bring first-author publications at NDSS and IEEE EuroS&P plus six years of pre-PhD offensive-security industry experience across national-scale financial infrastructure — spanning cloud and platform security, Kubernetes hardening, secrets management, static analysis, and penetration testing.
My research produces production-grade security systems evaluated across thousands of real-world applications. I designed and built LeakLess (NDSS 2025), KubeKeeper (EuroS&P 2025), LeakChain, and Confine — each combining systems research with large-scale empirical evaluation. I am a Catacosinos Fellow and Internet Society NDSS Fellow (both 2025).
Before my PhD, I was Head of Software Security at Sadad Electronic Payment Company, leading threat modeling, architecture reviews, and penetration testing for a national-scale banking ecosystem — manually exploiting XSS, SQL injection, SSRF, IDOR, authentication bypass, and RCE vulnerabilities in production financial infrastructure.
I am seeking roles in Security Engineering, Security Research, or Applied Scientist positions — with a focus on cloud security, platform security, security tooling, and applied security research. Green Card Holder.
Research & Projects
Production-grade tools deployed across hundreds of real-world applications, translating cutting-edge research into practical defenses.
In-memory encryption protecting sensitive data against Spectre/Meltdown-class transient execution attacks in serverless platforms. Implemented on Spin and evaluated on real-world serverless applications.
Cryptographic Secrets protection for Kubernetes using RBAC and Admission Webhooks, eliminating excessive-permission exposures across real-world cluster deployments.
IaC-aware static analysis framework (CodeQL) detecting sensitive-data leakage across distributed serverless applications, with an integrated LLM-based AI agent for flow validation. Designed as a CI/CD security guardrail.
Automated seccomp policy generation for containers via static binary analysis, filtering unnecessary system calls to dramatically reduce the kernel attack surface.
Experience
Feb 2021 – May 2026
Security & Privacy Researcher
HexLab, Stony Brook University — Stony Brook, NY
May 2018 – Feb 2021
Head of Software Security Team
Sadad Electronic Payment Company — Tehran, Iran
Feb 2017 – May 2018
Researcher & Senior Software Security Engineer
APA Research Center, Amirkabir University of Technology — Tehran, Iran
Dec 2015 – Feb 2017
Senior Web Application Security Engineer
Stock Exchange Organization — Tehran, Iran
Skills
Publications
LeakLess: Selective Data Protection Against Memory Leakage Attacks for Serverless Platforms
Fake APIs, Real Threats: Studying Activities Targeting APIs in the Wild
LeakChain: Detecting Sensitive Data Leakage Across Distributed Serverless Applications
Breaking the Gate: Detecting Invisible Authentication Slip-Through in NGINX Reverse Proxy
Awards & Honors
Catacosinos Fellowship for Academic Excellence and Research Potential
Department of Computer Science, Stony Brook University
Internet Society NDSS Fellowship
Network and Distributed System Security Symposium
CRA-WP Grad Cohort for Women & IDEALS
Computing Research Association
GAANN Fellowship (Graduate Assistance in Areas of National Need)
U.S. Department of Education
Graduate Students in STEM Leadership & Life Design Fellowship
Stony Brook University