NoahShaffer
Operating at the intersection of AI and offensive & defensive security. I architect agentic penetration testing pipelines, build RAG-driven compliance engines, and ship LLM-integrated security tooling across the full secure SDLC.
01. About
Who I Am
I'm a Cybersecurity Engineer and Associate of (ISC)² — I passed the CISSP exam and am accruing the 5 years of experience required for full certification. I have strong foundational coding knowledge built on years of hands-on development before AI tooling, and now operate at the intersection of AI and offensive & defensive security.
AI is my core engineering methodology. I architect agentic penetration testing pipelines, build RAG-driven compliance engines, and ship LLM-integrated security tooling across the full secure SDLC. Deep expertise in NIST AI RMF and MITRE ATLAS, including prompt injection defense, adversarial ML mitigation, and RAG pipeline hardening.
As Founder of Lockridge Security LLC and AI Software Engineer at ApexShield LLC, I'm building the next generation of AI-driven offensive security and compliance tooling. At Glacier Peak Capital, I secure regulated fixed-income trading systems under SEC Reg SCI, FINRA 4370, PCI-DSS, and SOC 2.
02. Skills
Core Competencies
AI-first security engineering across offensive pipelines, compliance automation, cloud, and application security.
AI/ML Engineering
AI Security & Governance
Languages & Development
Cloud & Infrastructure
Cybersecurity
Security Tools
Frameworks & Compliance
03. Experience
Professional Experience
AI Software Engineer — Sole Engineer, ShieldAudit Platform
- Architected a Next.js 16 / PostgreSQL application with Clerk auth, Drizzle ORM, and Neon serverless DB; enforced an immutable audit trail via database triggers to satisfy regulator evidentiary standards across all tenant environments.
- Engineered an 18-component, 40-question AI-assisted assessment engine with risk-weighted scoring aligned to NIST CSF, integrating LLM capabilities via prompt engineering and RAG to auto-generate audit findings, control gap summaries, and remediation narratives — with automated PDF/DOCX report output for regulatory submission.
- Delivered end-to-end penetration testing engagements as a managed service, leveraging the Lockridge Security agentic offensive platform to provide clients a unified compliance auditing and adversarial testing capability under one engagement.
- Designed and developed the ApexShield marketing and client-facing website, handling UX, copywriting, and deployment end-to-end.
Founder & Lead Security Engineer
- Architected and deployed a containerized offensive security platform integrating 40+ industry tools (Nmap, Nuclei, Metasploit, Hydra, SQLMap) within isolated Kali Linux environments, eliminating client infrastructure footprint across all engagements.
- Engineered a LangGraph-based agentic workflow to autonomously validate CVE exploitability, stress-test credential policies, and enumerate lateral movement paths — with configurable human approval gates at high-risk decision nodes.
- Produced prioritized vulnerability reports with AI-generated remediation recommendations, compressing client time-to-fix cycles and enabling development teams to action findings without manual triage overhead.
Security Engineer
- Developed and maintained SSPs and control narratives aligned with SEC Regulation SCI, FINRA Rule 4370, PCI-DSS, and SOC 2 for fixed-income trading systems handling CUSIP-level pricing and Treasury yield curve data.
- Conducted internal compliance audits and continuous control monitoring, assessing confidentiality, integrity, and availability of sensitive market data and escalating findings through formal remediation tracking.
- Performed risk assessments and gap analyses against PCI-DSS and SOC 2 frameworks, producing documented findings and tracking remediation actions to maintain continuous audit readiness.
- Executed vendor risk reviews for third parties with access to proprietary trading data, evaluating security controls and surfacing deficiencies against regulatory requirements.
- Owned BCP documentation and testing under FINRA Rule 4370, including tabletop exercises and failover validation to verify operational continuity under adverse conditions.
04. Certifications
Credentials
Certified Information Systems Security Professional
(ISC)² — Associate
Passed the CISSP examination — currently an Associate of (ISC)² accruing the required 5 years of professional security experience toward full certification.
Certified in Cybersecurity
(ISC)²
Entry-level certification demonstrating foundational knowledge of cybersecurity principles and best practices.
AWS Certified Security – Specialty
Amazon Web Services
AWS specialty certification validating advanced cloud security skills across identity, network, and data protection.
AI Security Certificate
In Progress
Certification covering AI/ML security risks, adversarial attacks, model hardening, and secure MLOps practices.
05. Education
Academic Background
University of San Diego
M.S., Cybersecurity Engineering
Expected August 2026
Florida State University
B.S., Computer Science
2024
06. Projects
GitHub Work
07. Contact
Get In Touch
Open to security engineering roles, consulting engagements, and collaboration.
NoahWilliamShaffer@gmail.com
linkedin.com/in/noahwilliamshaffer
GitHub
github.com/noahwilliamshaffer
Location
Tallahassee, FL
Security Engineering · Cloud Security · DevSecOps · Consulting