$ whoami_

Securing systems by thinking like the attacker. Building products that land half-million-dollar deals.

Senior security engineer specializing in fraud & bot detection, cloud security, and offensive research. Founder of Lambda Hackers and Excelsior Ops.

Esteban at DEF CON 34 holding his electronic badge
DEF CON 34 · Las Vegas

// Engineering experience at

FORTINET F5 Networks illumio AMERICAN EXPRESS Esurance UnitedHealth Group Lambda Hackers
8+years in security & software engineering
900%peak backend throughput gain on fraud engine
6companies across security, finance & health
CMUB.S. Electrical & Computer Engineering
Esteban at DEF CON 34 next to the giant FEDZ sign

Hi, I'm Esteban.

I build the systems that decide whether a request is a real customer or an attacker — and I spend my free time learning how to break them.

I'm now a cloud security engineer at Illumio. Before that, at Fortinet, I helped launch FortiGuard Advanced Bot Protection: hardening client-side telemetry with WebAssembly, designing AI-powered fraud rule engines in Go, and scaling the backend by up to 900%. Earlier I worked on identity security at American Express and bot defense at F5/Shape Security.

Outside the day job I run Lambda Hackers, an indie game studio, consult through Excelsior Ops, and get hands-on at DEF CON.

  • Fraud Detection
  • Bot Detection
  • Cloud Security
  • Security Posture
  • Compliance
  • Identity & Access Management
  • AI Model Pipelines
  • Software Architecture
  • Telemetry Ingestion

Where I've shipped security.

  1. Jun 2017

    UnitedHealth Group technology development internship

  2. 2017

    Took my first cybersecurity class — and fell in love with it

  3. 2018

    Graduated Carnegie Mellon University; joined Esurance

  4. Aug 2019

    American Express — identity & access management

  5. 2020

    Joined Shape Security / F5 Networks

  6. Jul 2022

    Joined Fortinet

  7. ★ WinSep 25, 2024

    Team launched FortiGuard Advanced Bot Protection

  8. ★ Win2026

    Team secured a half-million-dollar deal

  9. ★ Win2026

    Joined Illumio

  10. ★ WinDec 1, 2026

    Team launches PULSE

Scroll →

Roles in detail

  1. Senior Cloud Security Engineer · Illumio

    2026 – Present

    Part of the team launching PULSE on December 1, 2026. Add a short description of your responsibilities here.

  2. Senior Software Engineer · Fortinet

    Jul 2022 – 2026 · Sunnyvale, CA

    Engineering contributions to FortiGuard Advanced Bot Protection.

    • Converted obfuscated telemetry JavaScript to WebAssembly with hash-verified execution for tamper resistance & performance
    • Proposed nonce generation + backend cache to prevent replay attacks and data pollution
    • Designed the enterprise policy & rule schema and the management system for customer rule uploads
    • Built the Query Engine and AI-powered Rule Engine (Go gRPC, Vertex AI, Bigtable, Redis, Pub/Sub)
    • Researched GenAI pipelines to classify transaction types and assess risk for scraped retail sites
    • Merged Query Engine into Rule Engine (+400% throughput); porting Rule Executor to Go (+400–900%)
    • Team launched FortiGuard Advanced Bot Protection (Sep 25, 2024) and secured a half-million-dollar deal (2026)
  3. Software Engineer · F5 Networks / Shape Security

    San Jose, CA
  4. Identity Security Engineer · American Express

    Aug 2019 – Sep 2020 · Palo Alto, CA
  5. Software Engineer · Esurance

    May 2018 – Aug 2019 · San Francisco, CA

    Joined full-time in Nov 2018 after a summer software engineering internship.

  6. Technology Development Program Intern · UnitedHealth Group

    Jun 2017 – Aug 2017 · Schaumburg, IL

Products I helped ship.

Enterprise security products, built with the teams behind them, protecting customers in production.

Fortinet
Launched Sep 25, 2024

FortiGuard Advanced Bot Protection

Detects sophisticated, human-like bots using browser fingerprinting, behavioral biometrics, and machine learning that adapts as bots evolve.

My contributions

  • WebAssembly-hardened, tamper-evident telemetry client
  • AI-powered fraud Rule Engine & Query Engine in Go
  • Enterprise policy & rule management system
  • Backend throughput gains of 400–900%
  • Bot Defense
  • Fraud
  • ML
View product ↗
Illumio
Launching Dec 1, 2026

PULSE

Illumio's newest cloud security product, launching December 1, 2026. Full details coming at launch.

--days
--hours
--mins
--secs

My contributions

  • Add your contributions to PULSE here
  • Cloud Security
  • Launch 2026
Learn more ↗

An indie studio building a large-scale RPG-FPS.

Founder & solo developer · San Jose, CA · June 2025 – Present

Architecture

System design for every gameplay component, optimized in C++ for seamless play.

UI Systems

Weapon wheel, inventory management, and player-facing interfaces.

Physics

Tossable items, gravity manipulation, fire propagation, flammable liquids.

Adaptive AI

Enemies that react to environment changes and switch tactics to take you down.

Stealth & Mobility

Light detection, stealth mechanics, and jetpack combat.

Unreal Engine

Built in C++ on Unreal Engine for scale and fidelity.

Screenshots & demos

Interested in contributing to the game?

Artists, sound designers, and playtesters — let's talk.

Get in touch

Offensive security, done responsibly.

Certifications

  • OSCP
  • CEH
  • CompTIA Security+

Skills & Research

  • AV-Evasion Research
  • Authorized DDoS Testing
  • Firewalls
  • IAM
  • Dynamic Credential Salts
  • Rule Managers
  • Terraform
  • C++ / Go / Python

Demonstrations

Bluetooth Jammer

Add a short description: hardware/software used, the RF technique, and the controlled environment it was tested in.

Writeup / Engagement

Short description of the finding, exploit, or methodology used.

DEF CON hacking activities

Hardware
EV Charger Hijacking

The village or challenge, the charger protocol targeted, and what you demonstrated.

RF
RFID Card Spoofing

The card type, the tools used to read and clone it, and the result.

Human
Social Engineering

The scenario or competition, the pretext used, and what you learned.

Physical
Lockpicking

The lock types attempted and the techniques used.

All work performed under proper authorization and scope. Devices and techniques shown were tested only on owned hardware in isolated, controlled environments — never against third-party or production networks.

Let's build something secure.

Consulting, collaboration, speaking, or just talking shop about bot defense.