Security, privacy and AI governance leader with 20+ years across health tech, finance and consumer technology. Most recently Head of Product Security & Privacy Engineering (ISSO) at Verily (Alphabet). Design partner to ArmorIQ on agentic AI runtime security.
This is where I build in public: practitioner tools and references for securing agentic AI, especially where it touches regulated data. I build hands-on, mostly with Claude Code, and every agent I ship runs behind human-in-the-loop controls.
| Project | What it is |
|---|---|
| Agentic-Healthcare-HIPAA | HIPAA Security Rule × agentic AI control gap mapping. 16 HIPAA standards mapped to the OWASP Top 10 for Agentic Applications, 11 gaps rated (3 critical), 9 recommended safeguards, with 2024 NPRM impact analysis. |
| cyclyst | Self-hosted CE/CPE tracker for people holding multiple certifications. MCP connectors and a browser agent automate the busywork; every write is gated on human approval. Threat-modeled, 172 automated tests. |
| secleader-eval | Claude and Cursor skill that scores a company or job posting for senior leaders across trajectory, team maturity, compensation, culture and regulated-industry fit. |
- Agentic AI security: MCP, tool permissions, runtime intent controls, red teaming
- AI governance: NIST AI RMF, EU AI Act, OWASP Top 10 for LLM & Agentic Applications
- Regulated data: HIPAA, FedRAMP, SOC 2, ISO 27001, CCPA/GDPR
- Product security and privacy engineering at scale
- Writing, talks and advisory: mikhaelfelker.com
- Co-leader, OWASP San Fernando Valley chapter
Views and code here are my own and not endorsed by any current or former employer.