San Antonio, TX · Open to remote
Senior Threat Hunter and Detection Engineer focused on AI security
I find the adversary activity that slips past automated defenses, turn it into detections that hold up at scale, and work where AI and security meet.
whoami: kristofer todaro :: senior threat hunter. cat ./focus.txt: detection engineering · DFIR · AI security. ./status --availability: open to remote · listening for the right team.
01 / About
I am a threat hunter and detection engineer. I find adversary activity that evades automated tooling, then turn each finding into detections that hold up across large environments.
Most of my focus right now is AI security. That means two things at once: defending systems against AI-enabled attacks, and using AI to scale the slow, manual parts of hunting and detection. I think that intersection is one of the highest-priority problems in security today, and it is where I do my best work.
I have spent more than eight years in cybersecurity across federal, defense, and private-sector environments. For four years I ran hunt-forward missions against nation-state adversaries with the U.S. Cyber National Mission Force, including work supporting the defense of the 2020 U.S. elections against foreign influence operations. I then moved into managed detection and response at CrowdStrike, hunting across customer environments that spanned millions of endpoints.
Today I lead detection engineering and threat hunting on a federal contract. I am a U.S. Air Force veteran.
02 / Experience
Federal, defense, and private sector. Hunting nation-state adversaries, then building the detections that scale that work.
Federal contract
CrowdStrike
U.S. Cyber National Mission Force
03 / Skills & Certifications
M.S., Cybersecurity and Information Assurance
B.A., Psychology
Active TS/SCI with counter-intelligence polygraph
U.S. Air Force veteran
04 / Selected Work
Security tooling, self-hosted infrastructure, and builds that pushed how far I could take a problem on my own.
An interactive 2026 cybersecurity certification roadmap. Search, filter, compare, and plan a path across 14 domains including AI security. Built from scratch and self-hosted.
certs.cybershinobis.com ↗A self-run environment with a reverse proxy, split-horizon DNS, automatic TLS, and Cloudflare at the edge, serving several self-built apps over HTTPS with firewall rules and managed secrets.
After SunPower went bankrupt and a firmware update locked down the panel API, I built a self-hosted dashboard to keep monitoring my own solar array. A FastAPI service polls the authenticated PVS6 local API, with a mobile PWA front end and secure remote access over Tailscale instead of exposing anything to the internet.
A local-first home operations dashboard in Next.js and Prisma, designed with encrypted local secrets, an SSRF-aware AI adapter, and a no-cloud-by-default posture.
Custom tools that fill gaps in mainstream offerings: an ARM-native malware analysis VM that runs on Apple M1 and M2 hardware, and a remote network capture sensor using Zeek, Suricata, and NetFlow to extend SIEM visibility.
05 / Contact
If you are building a security team that takes the craft seriously, or working at the AI and security intersection, I would like to hear from you.
06 / FAQ
Ask AI
Open your assistant of choice with a prompt ready to run. It will summarize who I am, what I do, and how to reach me.