Making AI secure,
and worth using.
I'm Marco — an AI Senior Security Capability Engineer at Telstra. I assess AI-enabled systems — LLM applications, RAG pipelines, MCP and API integrations — for what they expose, where they're weak, and whether they actually deliver. That judgement rests on 20+ years of security engineering across Telstra, ANZ, TPG and the Australian Defence environment, and on building and testing AI systems of my own.
From securing identity to securing AI.
I'm an AI security and capability engineer. My job is to look hard at AI-enabled systems and answer two questions: is it safe, and does it actually do what it promises? That means tracing where data flows through prompts, retrieval and tool calls, finding where information can leak or controls fall short, and evaluating whether a capability is fit for purpose before a business leans on it.
I come to AI from two decades of security engineering — identity and access management, infrastructure, cloud and cybersecurity across some of Australia's largest and most complex environments, including Telstra, ANZ, TPG and the Australian Defence environment. The questions haven't changed much: who can access what, what's exposed, and where has complexity introduced risk. AI just raises the stakes.
I also build. Running my own AI systems on self-hosted models — and measuring their output against real outcomes — keeps my assessments grounded in how these tools behave in practice, not how they're marketed.
- AI Security Assessment — Information-exposure and security-gap analysis across LLM applications, RAG pipelines, MCP servers and AI integrations.
- AI Capability Evaluation — Technology evaluations, proofs of concept and evidence-based testing of whether an AI capability is fit for purpose.
- Hands-on AI Engineering — Prompt engineering, local LLM inference, speech-to-text pipelines and API integrations, built and run end to end.
- Security Foundations — Identity & access management, Essential Eight, application and cloud security across regulated, enterprise-scale environments.
Two decades of security. Now pointed at AI.
A condensed look at the roles that shaped it — full history on the CV.
AI systems I've built and tested myself.
Self-directed proofs of concept on self-hosted models — the hands-on practice behind how I assess AI capability: what works, what leaks, and what it really takes to run.
Nothing published here yet — check back soon.
The security groundwork behind it.
Before AI: identity and security engineering in some of Australia's most demanding environments — the experience I now bring to assessing AI systems.
Modernising Telstra's core identity platform
Led the migration of Telstra's production identity synchronisation platform from FIM to MIM (Windows Server 2008 → 2019), and directed Essential Eight Active Directory remediation with a 10+ person cross-functional team — including custom-built privileged identity lifecycle management.
Enterprise SSO at a top-4 bank
One of only two Azure Active Directory specialists at ANZ Bank, delivering multiple SSO integrations while supporting offshore delivery teams on both technical execution and ITIL process fundamentals.
AD platform for a 10,000-seat enterprise
Highest-level Active Directory escalation point for the Origin Energy account (10,000+ seats, 1,500+ production servers) at Hewlett Packard Enterprise. Built custom reporting and billing middleware that was later adopted into HPE's international script repository.
Multi-domain AD consolidation
Consolidated Active Directory domains and forests through TPG's acquisition of Vodafone, delivered remotely for worldwide IT managed services firm NTT Global.
What I actually work in, day to day.
AI Security
AI security governance, information-exposure analysis, RAG & MCP risk, secure AI integration patterns
AI Capability Assessment
Technology evaluations, proofs of concept, output evaluation & backtesting, fit-for-purpose analysis
LLM Engineering
Prompt engineering, RAG, MCP, APIs, self-hosted inference (Ollama), speech-to-text pipelines
Identity & Access Management
Active Directory, Microsoft Entra ID, FIM/MIM, SAML, SSO
Cyber & Cloud Security
Essential Eight, application security, cloud & corporate security controls, compliance
Solution Design & Automation
Architecture review, stakeholder delivery, PowerShell & process automation
Off the clock, you'll usually find me deep in motorsport — I run Marco Melbourne Motorsport on YouTube. Turns out the same instinct that debugs a directory sync issue is pretty handy for picking apart a race strategy.
Let's make AI work — securely.
Open to conversations about AI security, assessing AI capabilities, RAG and MCP integrations, or where AI genuinely fits into enterprise IT. Based in Melbourne — happy to chat remote too.