David R. Gillispie
Cybersecurity engineer working across application security, AI security, cloud security, identity and access management, vulnerability management, and penetration testing.
A public proof layer: tools, patterns, notes, and public-safe examples built without exposing employer data, client details, or NDA-protected work.
Public-safe utilities that make security checks and workflows you can actually inspect. Not employer tools, not client work.
Explore the lab →How I harden systems, reduce exposure, design controls, and turn risk into fixable work without exposing any private environment details.
Browse patterns →Short writing on cloud security, identity, AI tool risk, vulnerability workflows, and practical remediation from real engineering work.
Read the notes →A sanitized professional summary covering background, certifications, and focus areas. No internal metrics, no private environment details.
View resume →Four tools for vulnerability prioritization, identity risk mapping, AI workflow review, and security architecture planning. Each started as a checklist or spreadsheet. These are the formalized versions.
Walk through M365 and Entra ID controls, answer yes or no, and get a scored breakdown with specific findings. Built from the same checklist I use in identity security reviews.
CVSS alone misses context. Add whether the system is internet-facing, whether a public exploit exists, and what data is at risk. Score adjusts accordingly.
Describe any AI-enabled workflow in plain text and get a risk analysis: data exposure, third-party AI risks, governance gaps, and recommended controls.
Generate a practical security architecture based on company size, platform, work model, data sensitivity, and compliance needs. Includes a 30-day priority plan.
Everything runs in your browser. Nothing is sent anywhere.
Small, public-safe utilities. Each one reflects a real security concept you can run in a browser without sending data to any private system.
Open the full lab →Generalized patterns showing how I move from risk signal to design decision, fix path, validation, and repeatable control.
Conditional Access, MFA enforcement, legacy auth blocking, admin role scoping, and guest access controls.
Noisy scanner output turned into validated risk, owner-ready remediation, retest criteria, and closed findings.
Data movement, tool approval, human review, logging, vendor risk, and enforceable guardrails for AI-enabled workflows.
I care about what happens after risk is found: the fix, the rollout, the validation, and the repeatable control.
Know what exists, who owns it, what data it touches, and what should not change before recommending anything.
Map how risk actually travels: through identity, SaaS permissions, cloud configuration, or external exposure.
Scanner output is a starting point. Validate each finding against the actual environment before it becomes a remediation item.
Reduce exposure without creating new problems. Think through rollout risk, rollback options, and sign-off before implementation.
Findings become owner-ready tickets with specific steps, one owner, a definition of done, and retest criteria.
Retesting proves the fix. Documentation makes the improvement repeatable. Closure means the finding is actually gone.
As a kid, I took apart the family computer, learned Windows when the internet was off, wrote small batch scripts, and tried to understand how admin controls actually worked. I was not just interested in using computers. I was interested in making them do things, finding limits, bypassing restrictions, and figuring out why something failed.
One early lesson came from a screen-time control device connected to our TV. My stepdad kept changing the PIN because I kept figuring it out. What I was really doing was listening to the keypad tones, memorizing the pattern, and mapping the sounds back to numbers. At the time, I just wanted more video game time. Looking back, it was the same mindset that pulled me toward penetration testing later: observe the system, find the weak point, test the assumption, and understand the failure.
Cybersecurity gave that curiosity a responsible direction.
Full story on the about page →Cybersecurity engineer working across application security, AI security, cloud security, identity and access management, vulnerability management, and penetration testing. I currently lead internal AI security and penetration testing programs while running consulting engagements through DeepDream Security.
I also teach networking and cybersecurity as an adjunct instructor, which sharpens how I explain technical risk to non-security audiences.
External exposure reviews, web application security assessments, AI security reviews, Microsoft 365 hardening, and remediation planning for small and mid-size businesses.
Visit DeepDream Security ↗No employer data, client data, internal screenshots, private dashboards, exploit evidence, or NDA-protected details. Everything uses mock data, generalized patterns, and public-safe tooling.
Routing by intent: consulting, career, email, and Upwork.
Fixed-scope reviews, M365 hardening, external exposure reduction, AI security reviews, and remediation planning.
Full work history, professional background, and direct messaging for career conversations and roles.
For general inquiries, collaboration, speaking, or anything that does not fit the categories above.