Ethan Henderson
ethan@gnu.foo San Jose, CA
Experience
Multi-tenant zero-knowledge KYC platform handling sensitive identity-verification data for regulated customers (HIPAA, SOC 2, ISO 27001).
- Designed authentication and end-to-end encryption (AES-256-GCM) for a platform handling regulated customer data, with per-user key isolation so the control plane never has access to plaintext.
- Built the key management and access-control layer: time-limited access grants with usage ceilings, a least-privilege key hierarchy, and a tamper-evident (hash-chained) audit log.
- Deployed across cloud edge and isolated/attested compute environments (Cloudflare, AWS), with keys released only to verified workloads — tuned to ~80ms P99 at 500 requests/sec.
Built the security program from scratch at a 100+ person clinical organization that had no SIEM, IAM, monitoring, or compliance program in place.
- Built the organization's identity and access management from scratch across ~150 endpoints: single sign-on, Active Directory, Keycloak, Kerberos, and biometric authentication tied to shift-based access.
- Stood up a SIEM and monitoring pipeline using Sysmon, ELK (logs), and Prometheus/Grafana (metrics), covering system, network, and endpoint events.
- Ran the org's first HIPAA risk analysis (NIST SP 800-66), authored the supporting security controls, and closed 30–40 remediation items in 12 months.
- Designed and segmented the network (clinical / admin / guest / medical-device VLANs) with high-availability firewall failover, 802.1X network access control, and ZTNA for remote clinicians.
- Built supporting infrastructure on a 3-node Hyper-V failover cluster running IAM, ZTNA, and logging/telemetry services.
Publications & Specifications
| Publication | Description |
|---|---|
| AEAD AAD Canonicalization Specification |
Deterministic byte representation of authenticated metadata before encryption.
Includes conformance test vectors and a reference implementation (canaad).
|
| AEAD Encryption Envelope Wire Format Specification | Binary wire format covering key rotation, algorithm negotiation with downgrade prevention, and envelope encryption. |
| Technical Writing | Applied cryptography and security architecture publications, plus a 70-part vendor-agnostic networking curriculum (CCNA objectives). |
Technical Skills
- Detection & Monitoring
- SIEM, ELK, Sysmon, Prometheus/Grafana, endpoint & network telemetry, log analysis
- Identity & Access
- IAM, SSO, Active Directory, Keycloak, Kerberos, 802.1X NAC
- Network Security
- VLAN segmentation, firewall inspection, ZTNA, high-availability failover, identity-aware access
- Governance & Compliance
- HIPAA, SOC 2, ISO 27001, NIST SP 800-66 — risk analysis, controls authoring, remediation
- Platforms & Infrastructure
- Windows Server, Linux, Hyper-V failover clustering, Docker, AWS, Cloudflare
- Applied Cryptography
- Authenticated encryption, key management, protocol design (deeper specialist work in Publications below)
Projects
- httprift
- HTTP request-smuggling (desync) research platform with a differential engine for detecting parsing discrepancies across web servers (nginx, Apache).
- parlov
- HTTP oracle-detection tool that systematically probes for information leakage.
- canaad
- Reference implementation of the AAD canonicalization spec; ships as a library, CLI, and WebAssembly package.
- gtfo.dev
- Hands-on offensive-security demo: a multi-stage attack chain (injection, timing-based information disclosure, authentication bypass) deployed on Cloudflare edge.