I speak and write about AI, software architecture, cloud security, graph databases, and the engineering decisions behind real systems.
Cyber Security: A Peer-Reviewed Journal, forthcoming
Cloud-hosted AI agents blur traditional trust boundaries by combining probabilistic reasoning with retrieval, memory, and tool execution. This paper proposes a Zero Trust architecture for enterprise agentic systems, with external controls, continuous validation, and strict authorization at every interaction point.
Cyber Security: A Peer-Reviewed Journal, 8 (3), 281–298 (2025)
This paper examines the security challenges introduced by serverless computing and cloud infrastructure. It discusses defence in depth, the AWS Shared Responsibility Model, and the AWS Well-Architected Framework as foundations for building secure and resilient cloud systems.
Shopify Partners Blog, 2019
An interview about the role front-end developers play in protecting users from cross-site scripting, third-party scripts, and other browser-based threats. It covers Content Security Policy, modern frameworks, layered defences, and practical secure development practices.
Cyber Security: A Peer-Reviewed Journal, 1 (2), 175–186 (2017)
This paper explores authentication, authorization, session management, cryptography, and other security controls for Node.js applications in the context of a growing application-security threat landscape.
FOSSASIA Summit 2026, March 2026
This talk explores how knowledge graphs can help historians structure fragmented data and uncover relationships across time, geography, people, and artefacts. It also demonstrates how generative AI and Model Context Protocol can make complex historical datasets easier to query and investigate.
NODES 2025, November 2025
This talk explores how knowledge graphs can help historians structure fragmented data and uncover relationships across time, geography, people, and artefacts. It also demonstrates how generative AI and Model Context Protocol can make complex historical datasets easier to query and investigate.
Graph Database Singapore, May 2025
A hands-on introduction to graph databases, Neo4j, and the Cypher query language. The workshop covers connected-data modelling, querying, data import, and practical use cases such as recommendations and fraud detection.
FOSSASIA Summit 2025, April 2025
A hands-on introduction to graph databases, Neo4j, and the Cypher query language. The workshop covers connected-data modelling, querying, data import, and practical use cases such as recommendations and fraud detection.
Open Tech Summit Indonesia 2024, November 2024
This session shows how graph databases model highly connected systems that are difficult to represent with traditional relational structures. It combines Neo4j with Python, NetworkX, and PyVis for graph analysis and visualisation.
Singapore AWS Meetup, January 2024
This session shows how graph databases model highly connected systems that are difficult to represent with traditional relational structures. It combines Neo4j with Python, NetworkX, and PyVis for graph analysis and visualisation.
PyCon ID 2023, November 2023
This session shows how graph databases model highly connected systems that are difficult to represent with traditional relational structures. It combines Neo4j with Python, NetworkX, and PyVis for graph analysis and visualisation.
FOSSASIA Summit 2022, April 2022
A practical walkthrough of evolving a WordPress deployment from a basic server into a resilient AWS architecture. The session covers Amazon CloudFront, Application Load Balancer, Amazon S3, web-server choices, scaling, and cost considerations.
Singapore AWS Meetup, October 2021
A practical walkthrough of evolving a WordPress deployment from a basic server into a resilient AWS architecture. The session covers Amazon CloudFront, Application Load Balancer, Amazon S3, web-server choices, scaling, and cost considerations.
NDC Sydney 2020, October 2020
This session examines browser-based threats, cross-site scripting, third-party dependencies, and the limits of framework-level protection. It introduces practical defences, including Content Security Policy and layered application-security controls.
JavaScript Remote Conference 2020, May 2020
This session examines browser-based threats, cross-site scripting, third-party dependencies, and the limits of framework-level protection. It introduces practical defences, including Content Security Policy and layered application-security controls.
That Conference 2019, August 2019
This session examines browser-based threats, cross-site scripting, third-party dependencies, and the limits of framework-level protection. It introduces practical defences, including Content Security Policy and layered application-security controls.
FOSSASIA Summit 2019, March 2019
This session demonstrates how to secure React applications using reusable authentication components and preconfigured single sign-on. It covers IdentityServer4, secure routing, token handling, and claims-based authorization.
SingaporeJS, July 2018
An introduction to building voice-enabled browser applications with the Web Speech API. The session demonstrates speech recognition and text-to-speech without requiring specialist machine-learning infrastructure.
FOSSASIA Summit 2018, March 2018
This session covers performance engineering for ASP.NET Core applications, including caching, I/O, messaging, Linux deployment, containers, and practical methods for identifying bottlenecks.
FOSSASIA Summit 2018, March 2018
This session presents the database as a critical security boundary. Using PostgreSQL examples, it covers authentication, authorization, roles, encryption, and ways to protect sensitive data even when the application layer is compromised.
CFCamp 2017, October 2017
This session presents the database as a critical security boundary. Using PostgreSQL examples, it covers authentication, authorization, roles, encryption, and ways to protect sensitive data even when the application layer is compromised.
5th Scandinavian Conference on System and Software Safety, May 2016
This session examines security flaws that originate in system design rather than individual lines of code. It introduces architectural risk analysis through asset identification, threat modelling, and early assessment of security risks.
JS Remote Conf, March 2017
An introduction to building voice-enabled browser applications with the Web Speech API. The session demonstrates speech recognition and text-to-speech without requiring specialist machine-learning infrastructure.
NDC London 2017, January 2017
Practical guidance for securing Node.js and Express applications against common vulnerabilities. Topics include authentication, cryptography, security middleware, the OWASP Top 10, and supporting analysis tools.
NDC London 2017, January 2017
An introduction to building voice-enabled browser applications with the Web Speech API. The session demonstrates speech recognition and text-to-speech without requiring specialist machine-learning infrastructure.
Percona Live Europe, Amsterdam, October 2016
This session demonstrates how to build real-time applications with Node.js, ZeroMQ, and RethinkDB. It covers messaging patterns, cross-platform integration, and responsive data flows across web and desktop clients.
Angular Remote Conf, September 2016
An introduction to TypeScript for larger JavaScript applications, covering static typing, classes, interfaces, generics, decorators, and practical adoption strategies.
JavaScript Summit 2016, February 2016
This session explains the limitations of password-only authentication and demonstrates how to add two-factor authentication to Node.js applications using standards-based approaches and Google Authenticator.
DevFestMN 2016, February 2016
An introduction to TypeScript for larger JavaScript applications, covering static typing, classes, interfaces, generics, decorators, and practical adoption strategies.
NodeMN User Group, December 2015
This session demonstrates authentication in Node.js and Express applications with Passport.js, including form-based login, social authentication, and two-factor authentication.
Twin Cities .NET User Group, December 2015
A practical overview of C# 6 features including null-conditional operators, string interpolation, expression-bodied members, and nameof.
Open Source North 2015, October 2015
Practical guidance for securing Node.js and Express applications against common vulnerabilities. Topics include authentication, cryptography, security middleware, the OWASP Top 10, and supporting analysis tools.
That Conference 2015, August 2015
Practical guidance for securing Node.js and Express applications against common vulnerabilities. Topics include authentication, cryptography, security middleware, the OWASP Top 10, and supporting analysis tools.
dev.Objective() 2015, May 2015
A practical introduction to browser-to-browser voice, video, and peer-to-peer data exchange with WebRTC. The workshop covers browser support, security considerations, and the foundations of real-time web applications.
Twin Cities .NET User Group, May 2015
An introduction to TypeScript for larger JavaScript applications, covering static typing, classes, interfaces, generics, decorators, and practical adoption strategies.
JavaScriptMN User Group, April 2015
An introduction to TypeScript for larger JavaScript applications, covering static typing, classes, interfaces, generics, decorators, and practical adoption strategies.
DevFestMN 2015, March 2015
A practical introduction to browser-to-browser voice, video, and peer-to-peer data exchange with WebRTC. The workshop covers browser support, security considerations, and the foundations of real-time web applications.