Heyo 👋

I'm Rami (he/him). I'm a former security consultant, turned Product Security Engineer. Always happy to talk shop - you can find me on Twitter.

Some things I've done

Blogging

• tl;dr sec Security is a Team Sport
• 10 Things Your First Security Hire Shouldn’t Do
• Venture in Security Customer love: a recipe for building winning cybersecurity startups
• Deciding on S3 Intelligent Tiering
• The state of ABAC on AWS (in 2024)
• Did your research: Prior Art for “15 ideas for cloud security research”
• Steampipe + Access Advisor
• Quick Tip: Minimizing Terraformed SCPs
• A History of Human Interaction Proofs
• Risk in AWS SSM Port Forwarding
• Shipping RDS IAM Authentication (with a bastion host & SSM)
• rami.wiki
• A Guide to S3 Logging
• Reducing Attack Surface with AWS Allowlisting
• Return on Security Signal v. Noise in the RSA Innovation Sandbox
• AWS Phishing: Four Ways, AWS Could Do More About SSO Device Auth Phishing , and AWS SES Verification Phishing
• Datadog Security Labs A retrospective on public cloud breaches of 2022, with Rami McCarthy and Houston Hopkins
• tl;dr sec
  • How to securely build product features using AI APIs
  • Staff Security Engineer (stories)
  • Cloud Security Orienteering
  • Buying Security: A Client's Guide
• Removing sensitive data from a Github repository
• An AWS IAM Security Tooling Reference
• Cedar Defining Cedar's Security Values
• NCC Group
  • One Thousand Misspelled Security Headers
  • A guide to hardening enterprise Chromebooks (in three parts)
    • Part One: Baseline Security Posture
    • Part Two: ChromeOS Hardening
    • Part Three: Chrome Browser Configuration
  • The Extended AWS Security Ramp-up Guide
  • An offensive guide to the Authorization Code grant

Tooling

• Contributor to ScoutSuite as well as the proprietary branch
• Developer of sadcloud

Speaking

• SEC-T 0x0F - Beyond the Baseline: Horizons for Cloud Security Programs
• fwd:cloudsec 2023 - Beyond the AWS Security Maturity Roadmap
• BSidesSF May 2023 - Level Up Your Career: A Panel on Staff+ Engineering
• BSidesSF June 2022 - Buying Security: A Client's Guide
• OWASP DevSlop May 2022 - Learning from AWS (Customer) Security Incidents [2022]
• DEF CON Cloud Village 2021 - Cloud Security Orienteering
• BSidesCT 2020 - Learning from AWS (Customer) Security Incidents
• BSidesBOS 2020 - AWS Security: Easy Wins and Enterprise Scale
• BSidesCT 2019 - Building Castles in the Cloud: AWS Security and Self-Assessment
• OWASP BASC 2019 - AWS Cloud Security Fundamentals (4 hour workshop)