AI engineering and cybersecurity

JavierFlores

I build AI systems and software end to end, and lead hands-on cybersecurity: agents, machine learning models, production apps and security controls.

AI Engineer at Beacon Industries, a defense manufacturer, where I'm also the IT engineer and cybersecurity manager. Co-founder of NJ Developments. Glastonbury, Connecticut.

View projects Download resume Contact

Sandbox SPRS

110

of 110

All controls met

A sandbox scorer with one blade per NIST SP 800-171 control. Click a blade to fail it, drag to spin. Educational, not an assessment.

3.1.1 Limit system access to authorized users3.1.2 Limit access to permitted transactions and functions3.1.3 Control the flow of CUI3.1.4 Separate duties to reduce malevolent activity3.1.5 Employ the principle of least privilege3.1.6 Use non-privileged accounts for nonsecurity functions3.1.7 Restrict and log privileged function execution3.1.8 Limit unsuccessful logon attempts3.1.9 Provide privacy and security notices3.1.10 Use session lock with pattern-hiding displays3.1.11 Automatically terminate sessions after defined conditions3.1.12 Monitor and control remote access sessions3.1.13 Encrypt remote access sessions3.1.14 Route remote access via managed control points3.1.15 Authorize remote privileged commands and security info3.1.16 Authorize wireless access before connection3.1.17 Protect wireless with authentication and encryption3.1.18 Control connection of mobile devices3.1.19 Encrypt CUI on mobile devices3.1.20 Verify and control external system connections3.1.21 Limit portable storage on external systems3.1.22 Control CUI on publicly accessible systems3.2.1 Make users aware of security risks3.2.2 Train personnel for their security duties3.2.3 Train staff to recognize insider threat3.3.1 Create and retain system audit logs3.3.2 Trace user actions to individual users3.3.3 Review and update logged events3.3.4 Alert on audit logging process failure3.3.5 Correlate audit review, analysis, and reporting3.3.6 Provide audit reduction and report generation3.3.7 Synchronize system clocks to authoritative source3.3.8 Protect audit information and logging tools3.3.9 Limit audit management to privileged subset3.4.1 Maintain baseline configurations and system inventories3.4.2 Enforce security configuration settings3.4.3 Track, review, approve, and log changes3.4.4 Analyze security impact of changes first3.4.5 Define and enforce change access restrictions3.4.6 Configure systems for least functionality3.4.7 Disable nonessential programs, ports, protocols, services3.4.8 Apply deny-by-exception or permit-by-exception software policy3.4.9 Control and monitor user-installed software3.5.1 Identify users, processes, and devices3.5.2 Authenticate users, processes, and devices3.5.3 Use MFA for privileged and network access3.5.4 Use replay-resistant authentication for network access3.5.5 Prevent identifier reuse for defined period3.5.6 Disable identifiers after inactivity3.5.7 Enforce password complexity and character change3.5.8 Prohibit password reuse for set generations3.5.9 Require immediate change of temporary passwords3.5.10 Store and transmit only cryptographically-protected passwords3.5.11 Obscure authentication feedback3.6.1 Establish operational incident-handling capability3.6.2 Track, document, and report incidents3.6.3 Test incident response capability3.7.1 Perform system maintenance3.7.2 Control maintenance tools, techniques, and personnel3.7.3 Sanitize equipment removed for off-site maintenance3.7.4 Scan diagnostic media for malicious code3.7.5 Require MFA for nonlocal maintenance sessions3.7.6 Supervise maintenance personnel lacking access authorization3.8.1 Protect system media containing CUI3.8.2 Limit access to CUI on media3.8.3 Sanitize or destroy media before disposal3.8.4 Mark media with CUI markings3.8.5 Control and account for media in transport3.8.6 Encrypt CUI on digital media in transport3.8.7 Control use of removable media3.8.8 Prohibit portable storage with no identifiable owner3.8.9 Protect confidentiality of backup CUI3.9.1 Screen individuals before granting access3.9.2 Protect systems during terminations and transfers3.10.1 Limit physical access to authorized individuals3.10.2 Protect and monitor the physical facility3.10.3 Escort visitors and monitor visitor activity3.10.4 Maintain audit logs of physical access3.10.5 Control and manage physical access devices3.10.6 Safeguard CUI at alternate work sites3.11.1 Periodically assess organizational risk3.11.2 Scan for vulnerabilities periodically3.11.3 Remediate vulnerabilities per risk assessments3.12.1 Periodically assess security control effectiveness3.12.2 Implement plans of action for deficiencies3.12.3 Monitor security controls on ongoing basis3.12.4 Develop and update system security plans3.13.1 Monitor and protect boundary communications3.13.2 Use secure architecture and engineering principles3.13.3 Separate user and system management functionality3.13.4 Prevent information transfer via shared resources3.13.5 Separate subnetworks for public-facing components3.13.6 Deny network traffic by default3.13.7 Prevent split tunneling for remote devices3.13.8 Encrypt CUI in transmission3.13.9 Terminate idle or ended network connections3.13.10 Establish and manage cryptographic keys3.13.11 Use FIPS-validated cryptography for CUI3.13.12 Block remote activation of collaborative devices3.13.13 Control and monitor mobile code3.13.14 Control and monitor VoIP technologies3.13.15 Protect authenticity of communications sessions3.13.16 Protect confidentiality of CUI at rest3.14.1 Identify, report, and correct system flaws3.14.2 Protect against malicious code3.14.3 Monitor and act on security alerts3.14.4 Update malicious code protection mechanisms3.14.5 Perform periodic and real-time file scans3.14.6 Monitor systems and traffic for attacks3.14.7 Identify unauthorized use of systems

I build AI and software end to end for a manufacturer that makes turbine engine parts for the U.S. government, and I demo the work to NASA, U.S. Air Force and U.S. Navy leaders every week. I also run its cybersecurity and keep it ready for DoD assessors.

4: AI and software initiatives I own end to end
DIBCAC: Led readiness for a successful DoD assessment
30+: Production sites and apps shipped
1,000+: Users on the sites and apps I've shipped

Projects

In daily use

Knox

My personal AI agent. It keeps memory across sessions in plain files, reaches Gmail, Calendar, GitHub and internal APIs through MCP tools, runs scheduled jobs, and talks over real-time voice with cost-based routing between local and frontier models.

The guard is code: a hook runs before every tool call, checks shell commands and protected file writes against a deny list (wiping a disk, raw writes to a drive, killing the session it runs in, overwriting its own global config) and blocks matches outright. It catches known catastrophic patterns. It is not a sandbox.

The rest is policy: spending money, deleting data and messaging people wait for my explicit OK, and a failed tool call gets reported with its real error instead of guessed around.

One real run: it bought this site's domain. It found the name, filled the registrar checkout and stopped at the payment step until I picked the payment method and handed it the one-time code from my phone.

Python / Node / Claude API / MCP / Playwright / systemd / Linux

In production

CBNA member and event platform

Member and event platform for the Connecticut Business Networking Association, built through NJ Developments. I led technical delivery: member and nonmember registration, event payments, QR check-in with duplicate-scan protection, digital membership passes, attendee rosters and CSV exports, and an AI assistant on the public site.

Next.js / Firebase App Hosting / AI assistant

In progress

Evidence validation with specialist agents

Team capstone for my MS in Cybersecurity. Agents that each know one NIST SP 800-171 control family check submitted evidence against the requirement's assessment objectives, and a person makes the call. Write-up and code after December 2026.

NIST SP 800-171A / Agents / Evaluation

risk guardrisk guard

Research

btcv2

Trading research platform. A transformer forecasting model plus technical analysis across FX, crypto and equities, with broker API integration and eleven independent risk guards on execution, including drawdown limits, ATR position sizing and permanent safeguards against real-money orders.

Python / MetaTrader 5 API / CCXT / pandas

Experience

2026/Now

May 2026 to now

Beacon Industries

AI Engineer, also IT Engineer and Cybersecurity Manager Defense manufacturer in Newington, CT.

Own four AI and software initiatives start to finish, built on RAG, embeddings and agentic workflows with tool calling and structured outputs. I demo the work every week to NASA, U.S. Air Force and U.S. Navy technical and program leaders and turn their feedback into the next release.
Built an engineering-simulation surrogate model end to end, from simulation-data preparation through model development and evaluation, and presented the finished work.
Write the services myself in Python and TypeScript: React front ends, FastAPI and Node APIs, SQL/PostgreSQL and Firebase behind them, and the integrations that put real enterprise data in front of the model.
Led readiness for a successful DoD DIBCAC assessment with the ISSO and assessment team: updated the SSP, wrote and reviewed policies and procedures, drove remediation and walked the government auditors through the evidence.
Own CMMC and NIST SP 800-171 control implementation: the risk assessment, the identity, endpoint and network changes that satisfy each control, and the evidence that proves it at audit.
Cleared the enterprise vulnerability backlog, criticals first, with scripted remediation, patching, policy changes and compensating controls on legacy equipment that can't be patched. Built monitoring in Python, PowerShell, Intune and Defender XDR that catches recurring vulnerabilities and configuration drift.
One direct report. I give technical direction to the offshore offices and work directly with the ISSO and the Software Chief.

2022/26

Jan 2022 to Jun 2026

NJ Developments

Co-founder, Technical Lead Web and AI agency for Connecticut service businesses.

Co-founded the company with two partners. Led engineering and also handled outreach, discovery, proposals, pricing, demos and support across a seven-client portfolio.
Delivered 30+ production sites and applications supporting 1,000+ users. Hand-coded, mobile-first HTML, CSS and JavaScript on Firebase by default, and WordPress, Wix, Squarespace or Elementor when the client was already on one.
Built and self-hosted an internal AI knowledge assistant over the company's documents and operational data (LLM APIs, RAG, MCP tools), running 24/7 on a Linux VPS.
Built AI voice agents for 24/7 call answering, plus review and follow-up SMS automation for client lead capture.

2025/26

Jun 2025 to May 2026

Access Health CT

Information Technology Intern Hartford, CT.

Ran control analysis in RSA Archer against MARSE and ARC AMPE, documented the gaps, tracked remediation and worked the on-site security audits.
Administered an IT environment of 300+ users, produced evidence for a SOC 2 audit and ran access reviews.
Scored 9+ asset management platforms through vendor demos, presented the pick to IT, Finance and leadership, and helped lead the reconciliation of 2,000+ hardware assets into one inventory.

2024

May to Aug 2024

Connecticut Judicial Branch

Endpoint Management Intern East Hartford, CT.

Deployed and secured endpoints statewide with SCCM, Intune, Defender and PowerShell, and packaged and tested applications for the move from SCCM to Intune.
Wrote the statewide deployment documentation the team worked from. Hunted threats in Defender and triaged alerts.

2024

Apr to Aug 2024

theCoderSchool

Computer Science Instructor Glastonbury, CT.

Taught computer science to students ages 8 to 16, one on one and in larger classes.

The 110

Sandbox SPRS

110

of 110

All controls met

Every DoD contractor that handles CUI posts a score to SPRS. You start at 110 and lose 5, 3 or 1 point for each requirement that isn't met, down to a floor of −203. Mark what's missing here or on the turbine. The score, the CMMC Level 2 status and the POA&M list update together.

All 110 requirements met.

Estimated score and illustrative status from your selections. Educational, not an assessment or certification.

Show requirement text

How it's scored: 3.5.3 and 3.13.11 cost 3 points instead of 5 in their partial states. 3.12.4 has no point value, but without a current SSP there is no score at all. Conditional Level 2 status takes 88 or better, and the POA&M can only hold 1-point requirements (never 3.1.20, 3.1.22, 3.10.3, 3.10.4 or 3.10.5) plus 3.13.11 when encryption is in place but not FIPS-validated. Every POA&M item has to close within 180 days. This is self-assessment math: a real assessment checks each requirement against its objectives in NIST SP 800-171A. Sources: NIST SP 800-171 Rev. 2, DoD Assessment Methodology v1.2.1, 32 CFR 170.24, 32 CFR 170.21.

Education & skills

Expected May 2027

Master of Science, Cybersecurity

Quinnipiac University. Cloud security, Risk management (NIST SP 800-30, 800-39), Capstone.

May 2026

Bachelor of Science, Computer Science

Quinnipiac University. Minors in Criminal Justice and Management.

Security and GRC

CMMC, NIST SP 800-171, NIST 800-53, NIST CSF, RMF, CUI, SSPs and audit evidence, RSA Archer, SOC 2 evidence, Vulnerability management, Incident response, Threat hunting

Platforms and cloud

Intune, Entra ID, Defender XDR, Purview, Sentinel, Microsoft 365, Azure, AWS, Tenable, UniFi

Applied AI

RAG, Embeddings, Agents and tool calling, Structured outputs, Evaluation, MCP servers, Claude, OpenAI and Azure OpenAI

Software

Python, TypeScript, PowerShell, Bash, SQL, React, Node, FastAPI, PostgreSQL, Firebase, Docker, HTML and CSS

Let's talk.

javflores.ct@gmail.com

Resume (PDF)LinkedIn Markdown JSON