John Menerick
Eighteen years securing financial institutions, technology companies, startups, and public-sector organizations, including a Fortune 50 technology company's advanced R&D lab and a frontier AI lab — applying complex systems science to build defenses that evolve under pressure.
Most security programs assume more tools and more operators will keep pace with an ever-expanding attack surface. That assumption is wrong. Defense is a complex adaptive system — one that senses, responds, and evolves.
Drawing on TAME, TOTE feedback loops, and Ashby’s Law of Requisite Variety to engineer security architectures that self-correct under pressure, spanning application security, detection engineering, zero trust, cryptographic protocol design, and AI/ML security.
Core competencies
Threat modeling, secure code review, supply chain
Secure code review, SAST/DAST integration, threat modeling (STRIDE, PASTA, attack trees), secure SDLC design, API security, and supply chain hardening. Built security programs adopted across SDLC pipelines at a Fortune 50 technology company's advanced R&D lab and a frontier AI lab.
Detection engineering, SIEM pipelines, forensics
Detection engineering end-to-end, SIEM and telemetry pipeline design, IR and forensics, threat hunting, vulnerability management, and red team automation. Reduced MTTD from hours to minutes for clients including a Fortune 50 technology company's advanced R&D lab.
MPC, ZK proofs, TEE, PKI, formal verification
Zero trust and zero-knowledge architecture, MPC, threshold cryptography, SPIFFE/SPIRE, zk-SNARKs and zk-STARKs, BFT/PBFT, Paxos/Raft consensus security, TEE and confidential compute, side-channel mitigation, and formal verification of distributed protocols.
LLM security, federated learning, autonomous agents
LLM security and prompt injection defense, federated learning security, differential privacy, model poisoning defenses, energy model-driven simulations, autonomous agent security, distributed agent consensus, and verifiable inference in untrusted environments.
AWS/GCP/OCI, CI/CD hardening, service mesh
AWS, GCP, and OCI security architecture, secure CI/CD and IaC hardening, distributed systems security (consistency models, linearizability, causal ordering), container security and service mesh trust, workload orchestration security.
TAME, TOTE, Ashby’s Law, adaptive defense modeling
Applying the TAME framework, TOTE feedback loops, and Ashby’s Law of Requisite Variety to security architecture. Models the problem before reaching for a tool — mapping feedback loops and failure modes before writing a single detection rule.
Published research & open source
Whitepapers
Open source
Live intelligence dashboards
Volunteerism & public service
White House, Office of the President
- Contributor — Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence
- Contributor — National Strategy for Trusted Identities in Cyberspace (NSTIC)
Anthropic
- Project Glasswing participant
- Cyber Verification Program researcher
DARPA
- Cyber Grand Challenge finalist
- AI Cyber Challenge participant
US Department of Defense
- Satellite contributor
Public safety
- InfraGard — US critical infrastructure first responder
- Alameda County Sheriff’s OES Comm. Team — incident management
Cloud-native security governance
CNCF SIG Security member and Kubernetes SIG Security contributor — working on security standards, threat models, and policy guidance for cloud-native deployments.
CFP & CFW review board
Call-for-Papers and Call-for-Workshop reviewer for OWASP conferences, evaluating security research submissions for technical rigor and practitioner relevance.
Steering committee member
Contributing to cloud security standards, best practice guidance, and enterprise adoption frameworks.
DEF CON, ISC², CCC, ToorCon, GrrCON, DerbyCon, Skytalks, BSides, RootCon
Invited speaker and lecturer: 23 talks and lectures across 21 conferences, universities, and corporate events since 2002, spanning offensive security research, supply chain attacks, and AI security architecture.
Accomplishments
Black Badge holder
Awarded to winners of select DEF CON contests — earned by winning Hacker Jeopardy. Grants lifetime entry to DEF CON.
Tomb of the Unknown Soldier — wreath bearer
Wreath bearer in a wreath-laying ceremony at the Tomb of the Unknown Soldier, Arlington National Cemetery.
White House, Office of the President
- Letter of Recognition for Outstanding Achievements and Merit
US Congress
- US Senate — Resolution of Merit and Accomplishment
- US House of Representatives — Resolution of Recognition
Michigan State Senate
- Resolution of Merit and Accomplishment
Distinguished contributions to national security.
Distinguished contributions to national security.
Distinguished contributions to national security.
Distinguished contributions to national security.
Certifications
| Credential | Issuer |
|---|---|
| Security professional | |
| Certified Information Systems Security Professional (CISSP) | ISC² |
| InfoSec Assessment Methodology (IAM) I / II / III | NSA |
| InfoSec Evaluation Methodology (IEM) I / II / III | NSA |
| Certified Kubernetes Security Specialist (CKS) | CNCF |
| Certified Kubernetes Administrator (CKA) | CNCF |
| Professional Google Workspace Administrator | |
| Government & federal | |
| IS-100, IS-200, IS-700, IS-800 — Incident Command System | US FEMA |
| Public Trust | US Department of Justice / FBI |
| Other professional | |
| Certified Scrum Master | Scrum Alliance |
| Amateur Extra Class License (W8MEJ) | US FCC |
| GMRS License (WRJH688) | US FCC |
| LinkedIn Trusted Cryptographic Identity Portfolio | |
| Former or expired | |
| SANS elite portfolio (GXPN, GDAT, GX-IA, and others) former | SANS Institute |
| Professional Cloud Security Engineer expired | Google Cloud |
| OCI Foundations Associate expired | Oracle |
| OCI AI Foundations Associate expired | Oracle |
| OCI Data Management Foundations Associate expired | Oracle |
Training — Google Cloud Skills Boost (2025)
19 completions →| Course | Provider |
|---|---|
| Security operations | |
| Gemini for Security Engineers | Google Cloud Skills Boost |
| SecOps on GDC for Tier 1 and Tier 2 Analysts | Google Cloud Skills Boost |
| SecOps on GDC for Tier 3 Analysts | Google Cloud Skills Boost |
| GDC Air-Gapped Security Operator Fundamentals (quiz) | Google Cloud Skills Boost |
| Plan Your Cloud Next Generation Firewall Needs | Google Cloud Skills Boost |
| Generative AI & MLOps | |
| Introduction to Generative AI | Google Cloud Skills Boost |
| Introduction to Large Language Models | Google Cloud Skills Boost |
| Introduction to Vertex AI Studio | Google Cloud Skills Boost |
| Machine Learning Operations (MLOps) for Generative AI | Google Cloud Skills Boost |
| Vector Search and Embeddings | Google Cloud Skills Boost |
| Model architecture | |
| Attention Mechanism | Google Cloud Skills Boost |
| Encoder-Decoder Architecture | Google Cloud Skills Boost |
| Transformer Models and BERT Model | Google Cloud Skills Boost |
| Introduction to Image Generation | Google Cloud Skills Boost |
| Create Image Captioning Models | Google Cloud Skills Boost |
| Responsible AI | |
| Introduction to Responsible AI | Google Cloud Skills Boost |
| Responsible AI: Applying AI Principles with Google Cloud | Google Cloud Skills Boost |
| Responsible AI for Developers: Fairness & Bias | Google Cloud Skills Boost |
| Responsible AI for Developers: Privacy & Safety | Google Cloud Skills Boost |
Coding identity & developer rankings
CodersRank profile →Rankings derived from verified repository activity — not self-reported skills — independently computed from 627,824+ active developers worldwide.
579 consecutive days of commits
June 29, 2020 to January 28, 2022. CodersRank awards the GigaStreak badge for unbroken daily commit activity measured in hundreds of days. This streak is among the longest verified on the platform — sustained through security tooling, infrastructure automation, and open source research.
| Language | Score | World rank | US rank | Activity |
|---|---|---|---|---|
| TypeScript | 743.2 | Top 0.2% of 118K | Top 1% of 1K | |
| JavaScript | 424.8 | Top 0.5% of 279K | Top 3% of 2K | |
| JSON | 311.0 | Top 0.8% of 283K | Top 4% of 2K | |
| HCL | 206.2 | Top 0.7% of 8K | Top 3% of 70 | |
| Shell | 172.9 | Top 0.2% of 140K | Top 1% of 1K | |
| HTML | 144.2 | Top 2% of 292K | Top 5% of 2K | |
| CSS / SCSS | 120.9 / 101.1 | Top 2% of 266K | Top 4–6% | |
| PHP | 116.3 | Top 4% of 107K | Top 5% of 628 | |
| Python | 108.4 | Top 5% of 165K | Top 9% of 1K | |
| SQL | 83.7 | Top 0.2% of 52K | Top 1% of 440 | |
| TSQL | 62.9 | Top 0.3% of 55K | Top 2% of 395 | |
| PLpgSQL | 54.3 | Top 2% of 6K | Top 2% of 58 |
Work philosophy
Model before tooling
Maps feedback loops, failure modes, and emergent behavior before writing a single rule.
Build what doesn’t exist
Built IntelMetrics and VulnMetrics when the tooling wasn’t there. Ships solutions, not vendor evaluations.
Operate at both altitudes
Moves between executive architecture conversations and hands-on code review, packet captures, and IR triage in the same week.
Teach by doing
Pairs on active incidents and co-authors detections with junior engineers to build genuine systems thinking, not process compliance.
Defaults to transparency — publishing research and open-sourcing tooling so the community can build on it rather than rediscover it.
Perspective
How do you apply complex systems theory to security engineering?
Threat landscapes are nonlinear — attackers adapt, environments shift, controls interact unpredictably. Ashby’s Law of Requisite Variety ensures defensive systems match the adaptive capacity of threats. Practically: detection pipelines with self-tuning feedback loops, architectures where subsystem failure doesn’t cascade, and security operations treated as a living system rather than a fixed-state machine.
What’s missing from how most organizations approach security engineering today?
Three things. First, optimizing for compliance over resilience — while defenders check annual audit boxes, threat actors use AI-driven reconnaissance to compress the attack lifecycle toward near-zero. Second, the velocity gap from underinvestment in automation: without real-time telemetry pipelines and self-healing response workflows, you’re bringing a manual process to a machine-speed fight. Third, failure to treat security as a high-concurrency distributed systems problem. Security has to be a set of algorithmic guarantees, not a gate.
Identity
All credentials →$ whoami --verbose name John Menerick handles w8mej · Lord_SQL role Principal Security Engineer (Independent Consultant) — cloud, detection & response, zero-knowledge based Castro Valley, CA (SF Bay Area) callsign W8MEJ (FCC Amateur Extra) · GMRS WRJH688 identity keyoxide.org/hkp/[email protected] pgp 31E4 A5AB A427 601E AF2A BCE0 4643 6F93 8667 D7F6 uptime 18+ years in information security status open to full-time roles