EngSecLabs is where Alex Smolen writes about security engineering and ships open-source security tools. It started as a consulting practice. Alex now works full-time elsewhere, so the site is the blog and the projects.
Still open to the occasional project or advisory engagement. Email me at alex@engseclabs.com to say hello.
# open-source security tools $ ls projects/ trailtool/ # cloudtrail for ai agents iam-agent-proxy/ # least-privilege for aws agents graphgrc/ # soc 2 compliance in github $ cat blog/latest.md # notes on security engineering, # leadership, and practice. $ _
CloudTrail for AI agents. Pre-aggregates events into entities (people, sessions, roles, services) so agents can reason over cloud activity without blowing the context window.
Credential isolation and least privilege for AWS agents. Hands agents fake keys, re-signs each request with real credentials, and generates a least-privilege policy from observed behavior.
SOC 2 compliance in GitHub. Pre-written controls and policies in Markdown with semantic linking. Your compliance docs live in version control, queryable by AI, not locked in a SaaS platform.
I'm a security engineer with over a decade of experience building and breaking security-critical systems. I've worked across application security, cloud infrastructure, AI security, and compliance at startups and high-growth companies.
I write about security engineering here and on alexsmolen.com. If you're working through a hard security problem, I'd like to hear about it.
