Experience
AI Solution Developer | XM Cyber, Tel Aviv (IP acquired by CrowdStrike, 2026) April 2026 – Present
- Sole developer of an LLM system that audits the attack scenarios in a customer's environment, flags broken, redundant, misnamed or empty ones, and writes remediation advice. Scoped it from a one-line problem (customer scenarios go stale over time) to a working proof of concept; now moving it into the production codebase.
- Tool-calling loop over a SQLite index of the customer's entities, with the read-only query tools also served over MCP. Queries the index can't evaluate return "unknown" instead of 0.
- Each claim in the model's advice is checked against platform data, a claim that fails after one revision becomes generic text, and report numbers are computed in code. Customer data comes from the XM Cyber platform API through read-only calls; the system only advises and never writes customer data.
- Evaluation harness with ground-truth labels, A/B runs and an LLM judge; high-confidence findings reach ~88% precision. A 25-run cross-model benchmark found no significant difference between models.
- Wrote the anonymization layer that lets customer data reach an LLM. Identifiers become stable pseudonyms, and the run aborts if a known name still leaks.
- Wrote 16 detectors (6 LLM-backed, 10 deterministic) and ~1,100 tests, including a regression test for every false positive found in review. Also built the separate data pipeline that produces the system's tenant caches and entity inventory.
- Shipped two AI agents into the XM Cyber product.
Stack: Python (asyncio, httpx, Pydantic, pytest), SQLite, MCP, LLM APIs, C, Git, Bash
Projects
Archon | personal assistant agent over WhatsApp, Telegram, Gmail and Google Calendar (Python, ~8,900 lines)
- Every outgoing message, email and calendar edit waits for approval in Telegram. The 78 tools sit in a scope-filtered registry that hides privileged ones from the model unless the chat's policy allows them.
- One interface over five LLM backends (Anthropic, OpenAI, OpenRouter, Gemini and a sandboxed Claude Code subprocess), with per-call cost tracking and a daily budget cap.
- Eight subsystems run as supervised asyncio tasks that restart with backoff. Deployed on a systemd-sandboxed VM with no inbound ports and an egress monitor; CI blocks deploys when tests fail.
CVE-Sentinel | vulnerability intelligence service (Python, FastAPI, SQLAlchemy)
- Pulls NVD, CISA KEV and ExploitDB data into SQLite and sends Telegram and WebSocket alerts on high-risk CVEs. Adding an agent that answers questions about the data through an MCP-based SQL tool.
Other projects: ARM64 OS kernel from scratch (current Magshimim final project; C, AArch64, QEMU in Docker, CI); earlier LLM bots for Telegram and WhatsApp, and a ChatGPT Chrome extension.
Skills
LLM & agents: tool/function calling, MCP, structured output, evals, output verification, human-in-the-loop approval; Claude, OpenAI, Gemini and OpenRouter APIs
Backend & data: Python (asyncio, httpx, Pydantic, pytest), FastAPI, REST API integrations (OAuth, retries, rate limits), SQL (SQLite, SQLAlchemy), JavaScript/Node.js
Infrastructure: Docker, GitHub Actions CI/CD, Git, Linux, systemd
Low-level & security: C, C++, x86 and AArch64 assembly, IDA Pro, Wireshark
Languages: Hebrew and Russian (native), English (fluent, used daily at work)
Education
Magshimim National Cyber Program | Israel National Cyber Directorate, Magshimim Plus track 2024 – Present
Selective national program in cyber security. Year averages 97.5 and 99.7; reached the national CTF stage.
The Open University of Israel | Academy in High School program
Accepted to the B.Sc. Computer Science track; completed a first-year mathematics course.
High School Diploma | Excellence track, average 95+; 5 units in CS (100), Math, Physics, English, Russian Expected 2027