Services / Payments & embedded systems

Payments & embedded systems

Protect sensitive operations on exposed endpoints and constrained platforms, with controls that can be tested and explained.

Security has to survive the device.

Mobile payment applications and embedded platforms carry sensitive assets into environments where debugging, reverse engineering, malformed inputs, and operational failures are real design considerations.

I connect application protection, cryptographic integration, platform hardening, and evaluation evidence to the way the product is built and operated.

Focused engagements

A focused starting point

Security architecture review

Where are the most consequential design risks?

What you bring: Architecture diagrams, data flows, security requirements, and access to the engineers who own the system.
Scope: One agreed system or integration boundary. Implementation and penetration testing are scoped separately.
What you receive: Architecture findings, prioritized remediation, and an engineering debrief.
Timing: Agreed after reviewing system scope, access, and evidence availability.

Discuss this engagement

A focused starting point

Certification readiness review

What evidence or engineering gaps could delay evaluation?

What you bring: Target scheme and scope, design documentation, existing test evidence, and known evaluator questions.
Scope: Readiness assessment and engineering support. Formal evaluation and certification remain with the relevant laboratory and scheme.
What you receive: Evidence gaps, remediation priorities, and a practical evaluation-preparation plan.
Timing: Agreed after reviewing system scope, access, and evidence availability.

Discuss this engagement

Where I contribute

Mobile payments and wallets: endpoint threat models, secure storage, transaction signing, device binding, and runtime protection.
Embedded platforms: Linux/Yocto integration, binary hardening, cryptographic dependencies, SSH/TLS behaviour, and on-target verification.
Evaluation preparation: traceable control rationale, test evidence, lab questions, and prioritized defect remediation.
Implementation support: C/C++ integration, protocol debugging, crash analysis, and security tooling.

Experience behind the work

Ciena: host-software security for coherent optical transport platforms, including cryptographic stack modernization, vulnerability triage, and binary hardening.

Bank of Canada: mobile security architecture and a non-custodial CBDC wallet proof of concept, including key management, secure storage, transaction signing, and runtime security posture monitoring.

Amadis: mobile payment acceptance architecture, application protection, white-box cryptography, and mobile threat defense.

Irdeto: DRM and application protection, HSM-backed provisioning, and Linux security-module work.

Explore selected engineering experience

Start with the engineering problem

What needs to be secure?

Share your system, the decision ahead, and the constraints. We’ll work out a useful next step.

Discuss your project