NoahShaffer
Securing AWS-native SaaS platforms and ML pipelines against modern adversaries. Expertise across SIEM · Zero Trust · DevSecOps · AI/ML security automation.
01. About
Who I Am
I'm a CISSP-certified Cybersecurity Engineer with hands-on experience securing AWS-native SaaS platforms, regulated financial systems, and ML pipelines processing 2M+ events per day.
As Co-Founder & Founding Cybersecurity Engineer at Aurepath, I architect Zero Trust controls into an AI SaaS platform from day one. At Lockridge Cybersecurity LLC, I built ML-driven threat detection achieving 95%+ accuracy against BEC and credential phishing. At Curvature Securities, I protect regulated financial market data under SEC Reg SCI and FINRA Rule 4370.
Currently pursuing my M.S. in Cybersecurity Engineering at the University of San Diego (NSA/CAE-accredited), applying threat modeling, incident response, and AI/ML automation to harden cloud workloads against modern adversaries.
02. Skills
Core Competencies
Six years of hands-on security engineering across cloud, endpoint, network, and application layers.
CISSP Security Domains
Frameworks & Compliance
Security Tools & Platforms
Cloud & Infrastructure
Engineering & Practices
Languages & ML
03. Experience
Professional Experience
Co-Founder & Founding Cybersecurity Engineer
- Lead security architecture for an AWS-native AI SaaS platform, embedding Zero Trust controls across IAM, secrets management, KMS-backed encryption, and VPC network segmentation from day one; secured $2.5K pre-seed funding and signed first enterprise design partner.
- Built a secure SDLC and DevSecOps pipeline (CI/CD with GitHub Actions, SAST via Semgrep, DAST, Snyk dependency scanning, Trivy container scanning, Terraform IaC review), reducing mean time to remediate critical vulnerabilities by 40%.
- Designed and deployed REST APIs handling 10K+ daily calls with TLS 1.3, OAuth 2.0 / OIDC, rate limiting, and structured logging into a centralized SIEM, achieving sub-100ms p95 latency.
- Authored security policies, risk register, and control mappings aligned to SOC 2 Type II, NIST CSF, and ISO 27001 to accelerate enterprise pilot conversations and audit readiness.
- Conducted threat modeling (STRIDE) and tabletop incident response exercises across the platform, producing prioritized remediation roadmaps tied to MITRE ATT&CK coverage gaps.
Software Engineer — Sole Engineer, ShieldAudit Platform
- Sole engineer designing and building ShieldAudit — a SaaS platform automating annual CCPA cybersecurity audits required under Cal. Code Regs. tit. 11, §§ 7120–7124 (effective January 1, 2026).
- Architected a multi-tenant Next.js / PostgreSQL application with Clerk authentication, Drizzle ORM, and Neon serverless DB; implemented an immutable audit trail enforced at the database trigger level.
- Built an 18-component, 40-question assessment engine with risk-weighted scoring aligned to NIST CSF, producing automated PDF/DOCX reports formatted for regulatory submission.
- Implemented Stripe per-assessment billing with white-label reseller tier; productized at $9,500 direct and $300–$500 reseller price points for California covered businesses.
- Hardened with row-level tenancy isolation, AES-256 PII encryption at rest, TLS 1.3 in transit, CSP/HSTS headers, OWASP Top 10 mitigations, and continuous dependency scanning.
Founder & Lead Security / ML Engineer
- Founded a security practice focused on ML-driven threat intelligence; deployed production PyTorch and TensorFlow models for phishing detection and malware classification across a pipeline processing 2M+ emails per day.
- Built supervised and unsupervised anomaly detection systems achieving 95%+ validated accuracy against BEC, credential phishing, and malicious attachments.
- Scaled MLOps infrastructure on AWS using Docker, Kubernetes (EKS), and Argo Workflows, enabling 10x traffic with automated retraining, drift monitoring, model versioning, and OpenTelemetry observability.
- Mapped detection coverage to MITRE ATT&CK (Initial Access, Defense Evasion) and authored runbooks for SOC analysts integrating outputs into Splunk and downstream SOAR playbooks.
Security Engineer
- Monitor and secure access to sensitive fixed-income market data — including real-time CUSIP-level pricing (BVAL, discount, and dollar prices), Treasury yield curves, OAS/repo spreads, and hedge calculations — across trading and analytics systems.
- Apply data integrity and access control standards aligned with SEC Regulation SCI, FINRA Rule 4370, PCI-DSS, and SOC 2 to ensure CIA of proprietary trading data.
- Operate and tune SIEM detections, EDR alerts, and DLP policies for insider-threat and market-data exfiltration scenarios; triage and remediate incidents per documented Reg SCI escalation procedures.
- Lead quarterly vulnerability management and patch cadence across Windows and Linux trading infrastructure.
- Contribute to FINRA 4370 BC/DR testing including failover validation, tabletop exercises, and post-incident reporting.
04. Certifications
Credentials
Certified Information Systems Security Professional
(ISC)²
The gold standard in cybersecurity certification, validating expertise across all 8 CISSP security domains.
Certified in Cybersecurity
(ISC)²
Entry-level certification demonstrating foundational knowledge of cybersecurity principles and best practices.
AWS Certified Security – Specialty
Amazon Web Services
AWS specialty certification validating advanced cloud security skills across identity, network, and data protection.
AI Security Certificate
In Progress
Certification covering AI/ML security risks, adversarial attacks, model hardening, and secure MLOps practices.
05. Education
Academic Background
University of San Diego
M.S., Cybersecurity Engineering
Expected August 2026
Florida State University
B.S., Computer Science
2024
06. Projects
GitHub Work
07. Contact
Get In Touch
Open to security engineering roles, consulting engagements, and collaboration.
NoahWilliamShaffer@gmail.com
linkedin.com/in/noahwilliamshaffer
GitHub
github.com/noahwilliamshaffer
Location
Tallahassee, FL
Security Engineering · Cloud Security · DevSecOps · Consulting