Aaron SawitSecurity engineer · Singapore

Security engineer · Singapore

Security engineer who builds.

Risk and compliance by day. In my own time I ship products people use, run my own infrastructure, put guardrails on AI, and trace every failure to its real cause.

Read my CV See the work LinkedIn

designed, built and run by meSelected work

Each one opens into a short case study: what it is, the decisions, and the mistakes.

  1. Versed Study home page showing a pixel-art cat cafe study room

    Product suite, solo

    Versed

    Four free learning tools for students, tutors and teachers. I designed, coded and run all of it.

    • 4 products live
    • 0 accounts needed to play
    • 1 person: design, code, ops
    Read the case study
  2. phoneanywhere laptophome or away TV boxliving room WireGuard, end to end one server2017 gaming PC · 2 GPUs · 40+ apps DNS filterfor every device VPN exit nodefails closed photos · passwordsdocuments · recipes media serverGPU transcoding game streamingheadless 1080p60 local LLMsacross both GPUs backups · uptime checks · alertsrebuilt from one folder public internet0 open ports blocked

    Infrastructure, self-hosted

    One box, forty services

    A recycled gaming PC running my family's photos, passwords, media and AI, reachable from anywhere and exposed to no one.

    • 40+ services
    • 0 ports open to the internet
    • 14 days of restorable backups
    Read the case study

smaller, sharperMore work

Performance work on old hardware, and security tooling with tests that pass in public.

  1. Decode speed, tokens per second 35B MoE model · 2× GTX 1080 Ti · same hardware default runtime46 + speculative decoding43net loss quantised cache, 64K42not free tuned, full 32K depth60 tuned, empty context71 48K context passed every check, then crashed. Test at full depth.

    Performance engineering

    Local AI on 2017 hardware

    A 35-billion-parameter model made 44% faster on nine-year-old GPUs by measuring every assumption.

    • 46 to 71 tokens a second
    • +44% on the same hardware
    • 1 crash found before it shipped
    Read the case study
  2. Rules decide. The model votes on the rest. 1 parseRFC 5424named errors 2 detectbrute force · cronIOC matches 3 enrichGeoIPindicator context 4 classifyLLM, temp 0strict format sshd: Failed password for root from 203.0.113.5 rule ssh_bruteforce · ioc_hit (Tor exit node) geo NL verdict malicious · confidence 0.95 Off-format model output is discarded, never guessed at.

    Blue team, Python

    Detection tooling

    A log triage pipeline, a phishing link checker and tested Sigma rules, all public with passing builds.

    • 4 Sigma rules, ATT&CK mapped, green in CI
    • 36 offline tests on the triage tool
    • 3 public repositories with passing builds
    Read the case study

Also built

limits, tests and a human in chargeAI engineering

I use AI every day and I do not trust it by default. Everything here runs with a limit, a test or a human check around the model, because that is the part most AI projects skip.

  1. Versed

    AI inside a free product for kids

    A capped AI helper in Versed Study and AI-built flashcard decks in Versed Learn, in tools used by students.

    The guardrailPer-visitor and per-day limits enforced in a Durable Object after I proved a KV counter could not hold a rate limit. Deck generation is costed at about 3 cents a deck, so the free tier has a real number behind it. No user photo uploads on public content, and chat runs through a word filter with reports.

    Write-up: the rate limit that did not limit

  2. blue-team-ai, open source

    An LLM in a security pipeline

    Syslog triage where detection rules and threat-intel matches run first and a language model classifies only what the rules could not settle.

    The guardrailTemperature zero, one fixed answer format, off-format replies discarded. If the API is down the run falls back to the rule results instead of failing. 36 offline tests with the model client faked.

    Code and passing tests on GitHub

  3. Home server, 2x GTX 1080 Ti

    Running large models on my own hardware

    A 35-billion-parameter model served locally to a chat interface and an agent workspace, on nine-year-old GPUs that current toolkits have dropped.

    The guardrail46 to 71 tokens a second from measured changes only. A 48K context passed every normal check and then crashed mid-generation, so I now ship only configurations that finish a run at full depth. A script frees GPU memory when a game starts.

    Write-up: the benchmarks, including what made it worse

All 8 AI projects, and the six rules I build them by

reported symptom, then the actual causeRoot-cause write-ups

Real failures from systems I run. I do not stop at the symptom.

what they saidwhat it was

  1. A per-minute request cap let through several times the cap. KV reads are cached for a minute. A stale counter cannot enforce a window. SOLVED
  2. Ad blocking stopped on one phone. The filter logged nothing. iCloud Private Relay resolves names through Apple, so the filter was never asked. SOLVED
  3. One TV channel played everywhere except my media server. ffmpeg 7.1 refuses video segments whose URL has no file extension. SOLVED
  4. Three GPU services died at the same minute and nothing logged an error. A systemd reload wiped device rules Docker never knew about. SOLVED
  5. The emulator rejected every disc image I dumped. Full dumps put the game partition at 0x18310000. The emulator reads 0x10000. SOLVED
  6. Game streams worked but looked soft and lagged. The encoder was built without this GPU's kernels and silently fell back to the CPU. SOLVED
  7. The agent says it will search the web, then does nothing. A hidden text-only tool mode, plus tool definitions silently cut off by a context mismatch. SOLVED
  8. A 35B model ran at 46 tokens a second. Was that the hardware? No. Runtime and four defaults. 71 tokens a second on the same cards. SOLVED

All 15 write-ups · 4 tested detection rules

three kinds of workWhat I bring to a team

Three kinds of work, and the tools I reach for in each.

Detection and response

Log analysis, SIEM work and incident handling. I write detections other people can read and test, and I investigate until there is one named cause.

  • Nmap
  • Wireshark
  • tcpdump
  • Scapy
  • Netcat
  • Metasploit
  • Hashcat
  • John the Ripper
  • Mimikatz

Security-minded infrastructure

Linux, containers, networking and monitoring, run as code with backups I have restored from and a threat model I can explain.

  • Linux
  • Docker and Compose
  • systemd
  • iptables and policy routing
  • WireGuard and Tailscale
  • DNS filtering
  • backups and monitoring
  • infrastructure as scripts

Shipping secure products

I take products from a blank page to real users on Cloudflare's edge, and make the privacy and abuse decisions as part of the design.

  • Cloudflare Workers
  • Durable Objects
  • D1 and KV
  • Pages Functions
  • TypeScript
  • authentication with scrypt and cookie sessions
  • rate limiting and abuse controls
  • CSP and security headers

About

Aaron Sawit

I work in cybersecurity full time, on the risk and compliance side, and I tutor special needs students on the side. The tutoring is why the Versed tools exist and why they are free: the kids I teach needed calmer, simpler tools than the ones schools pay for, so I built them.

My training is hands-on. I hold the GIAC Certified Incident Handler, worked through Hack The Box's SOC analyst path, and reached Level 5 of the CSIT TISC capture-the-flag. I like the moment a vague symptom turns into one specific line in one specific log.

Six years of teaching children who struggle with text has made me good at one thing most engineers avoid: explaining something hard to someone who is not technical, without talking down to them.

Get in touch

I reply to every message, and I am happy to walk through anything here on a call.

Message me on LinkedIn CV GitHub