Product security for regulated medical software. Biomedical engineer turned security specialist - I turn STRIDE threat models into concrete, traceable security requirements and back them with SBOM-driven SCA, static analysis, and black-box dynamic testing.
Currently QA/RA & Security Specialist at Hermes Medical Solutions in Stockholm, working on secure SDLC for medical devices, FDA premarket cybersecurity and IEC 81001-5-1, AppSec, and the AI security work and regulatory evidence AI-enabled devices need. Building toward product and application security engineering.
15 merged pull requests into 8 security and medical-imaging projects:
| Project | Merged | What |
|---|---|---|
| fo-dicom | 3 | Depth guard in the DICOM reader against unbounded SQ recursion (#2114); network-layer fixes - a .NET 8 enum-format crash in RawPDU.ToString (#2147) and an unobserved per-connection service task exception in DicomServer (#2149) |
| fo-dicom.Codecs | 3 | Decoder input validation: reject a JPEG 2000 (#190) or HTJ2K (#192) codestream that does not fit the declared pixel buffer; fix a process crash on a JPEG referencing an undefined Huffman table (#181) |
| DefectDojo | 2 | Parsers for two LLM security scanners: Garak, an LLM vulnerability scanner (#15013), and Promptfoo, LLM eval and red-teaming (#15081) |
| syft | 2 | SBOM field correctness: exclude the distro group from the CycloneDX package name (#4791); extract the License field for opkg/ipkg entries (#4963) |
| grype | 2 | Honour the match.rust.using-cpes configuration instead of ignoring it (#3611); small change - warn when an insecure registry transport is configured (#3396) |
| presidio | 1 | Small docs fix - an undefined variable in the Document Intelligence image-redaction example (#2089) |
| stereoscope | 1 | Small change - one log line when the registry transport is configured insecurely (#587) |
| purl2cpe | 1 | Small data addition - a PURL-to-CPE mapping for Crypto++, whose 29 NVD CPE entries previously resolved to nothing (#32) |
Open PRs under review: bounding the inflated size of a deflated dataset in the DICOM reader at fo-dicom, Terraform OIDC trust-policy checks at checkov, plus pydicom and cartography.
- subvectors - cited, versioned conformance
vectors for CI/CD OIDC trust decisions: does subject S satisfy trust condition C,
and is C safe? Covers GitHub/GitLab issuers against AWS/Azure/GCP consumers.
On PyPI (
pip install subvectors) with the full corpus in the wheel. - subcheck - decodes and validates GitHub Actions
OIDC token claims against an expected-claims policy. A CI gate against trust-policy
drift, differentially tested against the pinned subvectors corpus.
On PyPI (
pip install subcheck) and usable as a GitHub Action. - portfolio-site - full-stack personal site (Vue 3 + TypeScript, FastAPI) with GitHub OAuth, analytics and an admin CMS.
- CompTIA Security+ (2026)