Brad Geesaman

Summary

Throughout my career, I have partnered with security and engineering teams to find what matters most in their environments and turn it into practical change. Most recently, as a Forward Deployed Engineer at Ghost Security, I built AI agents that do real security work for enterprise teams, with a focus on trust, transparency, safety, and leveling up my clients. Before that, I advised organizations on securing AWS, Google Cloud, and Kubernetes as a cloud security consultancy co-founder and a Google Cloud PSO consultant. My background also includes vuln research, pen-testing, security operations, and CTF/cyber range development.

Experience

2022-2026

Principal Security Engineer / Forward Deployed Engineer, Ghost Security

• Worked directly with enterprise security teams to understand their workflows and priorities, then designed and built production AI agents, and the platforms they run on, delivering AI-native application security scanning across more than 15,000 enterprise repositories.
• Translated customer and community feedback into product and sales priorities so that features landed and delivered value.
• Built the core foundation of Ghost’s cloud and application security repository scanning platform on GCP using serverless technologies (Cloud Run/Jobs, Cloud Tasks, GCS, Firestore, Container Analysis, and more).
• Represented Ghost in the AppSec and developer community with vulnerability research, talks, workshops, blogs, videos, and releases of open-source application security SKILL repos.
• Led R&D of agentic-AI application security platform capabilities, including ReaperBot, an agentic framework for autonomous web app recon and fuzz testing via Reaper.
• Responsible for all SRE, Code Security, and platform security posture activities in our GCP and AWS environments.

2021-2022

Director of Cloud Security, Aqua Security

• Technical lead for research and early product development of agentless cloud and container security capabilities across AWS, Azure, and Google Cloud.
• Designed and prototyped block store and disk snapshot scanning of cloud workloads and container hosts, which landed a major streaming video service as the first customer.

2019-2021

Co-founder, Chief Architect, Darkbit.io

• Advised engineering and security leaders at cloud-native organizations on the security posture of their AWS, Google Cloud, and Kubernetes environments through point-in-time assessments and continuous monitoring engagements.
• Turned assessment findings into prioritized remediation plans fit to each client’s architecture and engineering capacity.
• Co-developed and open-sourced OpenCSPM, a graph-database engine for efficiently assessing the security posture of AWS, Google Cloud, and Kubernetes resources.
• Developed and tested exam challenges for the Certified Kubernetes Security Specialist (CKS) certification.

2018-2020

Professional Services Consultant (Contractor/TVC), Google Cloud (PSO)

• Engaged with multiple clients migrating to Google Cloud and Google Kubernetes Engine (GKE). Performed security configuration reviews with strategic security guidance to client management.
• Delivered multiple internal GKE/Security educational assets and training sessions used by the greater Google Cloud Partner ecosystem.
• One of the first 20 to qualify for the Google Cloud Certified Fellow Program.

2018-2020

Independent Security Consultant, Bradley Geesaman Consulting

• Delivered practical security guidance, expertise, implementation assistance, and security training to several clients deploying mission-critical workloads inside Kubernetes on bare metal, AWS, and GKE.
• Designed, developed, and automated the cluster and deployment pipelines of a multi-team AWS/Kubernetes-based platform performing security analytics at 60K logs/sec into Elasticsearch.

2015-2017

Senior Manager, CTF/Simulation Development, Symantec Corporation

• Led the CTF/simulation development team behind the Symantec Cyberwar Games and Cyberskills exercises, played by over 5,000 ethical hackers.
• Led the team that successfully hosted a one-week, 1500 person, company-wide Capture-the-Flag event inside 10 AWS regions on top of multiple, hardened Kubernetes clusters.
• Architected and built a fully automated Kubernetes cluster deployment tool on AWS to support the containerized targets on the Symantec Cyberskills platform.
• Built and managed the federated logging and performance system used to monitor cluster and container health using ELK and Prometheus/Grafana.

2014-2015

CTO, Blackfin Security Group - Acquired by Symantec Corporation

• Led the technical operations team focused on delivering cutting-edge, realistic, and immersive training solutions to improve security awareness for large organizations and “hands-on” experience to expert security personnel charged with defending their data.
• Managed the Customer Support, Operations, and Internal IT teams.
• Administered The Hacker Academy, an ethical hacking subscription learning platform on top of AWS via Infrastructure as Code and Configuration Management.

2012-2014

Chief Architect, MAD Security

• Led and managed the team that designed, built, and delivered capture-the-flag (CTF) style ethical hacking/cyber wargames challenges designed for security professionals. The challenges have been played by over 9,000 professionals world-wide in over 200 events of 20-1,000 participants, lasting 2 hours to 30 days (24/7).
• Delivered several one-day bootcamp instructional training sessions covering security penetration-testing basic concepts complete with custom CTF scenarios for hands-on skills reinforcement.

2008-2012

Sales Engineer, Check Point Software Technologies

• Responsible for technical pre-sales support for the design, migration/implementation, and operation of security gateway solutions for Federal Civilian Agencies.
• “2009 North American Security Engineer of the Year” Award for outstanding team performance and customer satisfaction.

2006-2008

Manager, Security Assessment Services, Securicon

• Managed numerous security assessments and audits from kick-off to final delivery for financial, power/energy, and gas pipeline companies. Led small teams in electronic and physical penetration testing, vulnerability assessments, and solutions review.
• Formalized and streamlined the client engagement assessment data collection process to reduce final deliverable draft and completion time by up to 50%.

2002-2006

Earlier Roles

• Security Engineer to Principal Security Engineer, Symantec Managed Security Services (2003-2006): Tier 3 SOC engineering support for Fortune 100/500 customers, and built a fault and performance monitoring system that cut 5% of daily engineering workload.
• Systems Engineer, PEC Solutions (2002-2003): secure transmission of electronic fingerprints and photos for Federal hiring at remote sites.

Speaking

Ghost Security 2026 Ghost Security Agent Skills - Scan-Code

Boring AppSec Podcast 2025 From Toil to Intelligence: The Future of AppSec with AI Agents

Scale to Zero Podcast 2025 AI in AppSec: The Paradigm Shift

KubeCon EU 2023 Malicious Compliance: Reflections on Trusting Container Scanners

KubeCon NA 2021 Exploiting a Slightly Peculiar Volume Configuration with SIG-Honk

KubeCon NA 2021 Kubernetes Exposed! Seven of Nine Hidden Secrets That Will Give You Pause

KubeCon NA 2020 Keynote Panel: Hacking and Hardening in the Cloud Native Garden

CSA Boston Oct 2020 Kubernetes Attacks: What Your Cluster Is Trying To Tell You

RSA 2020/KubeCon EU 2020 Advanced Persistence Threats: The Future of Kubernetes Attacks

KubeCon NA 2019 Attacking and Defending Kubernetes Clusters: A Guided Tour

BlackHat USA 2018 Detecting Malicious Cloud Account Behavior

KubeCon NA 2017 Hacking and Hardening Kubernetes Clusters By Example

Vuln Research

2026 CVE-2026-53950 High-Severity XSS in Ghost CMS ActivityPub Client, found using Ghost Security AI Skills

2020 CVE-2020-15157 “ContainerDrip” Write-up (advisory) and Google 2020 VRP Prize Winner

Falco Default Rule Bypass

Container Registry Search Order/Registry Name Squatting

2019 CVE-2019-11253 Kubernetes DoS Writeup

kube-env-stealer - Automated GKE kubelet impersonation and cluster secret stealer via kube-env

2018 subpath-exploit - CVE-2017-1002101 write-up with sample exploit/escape

Open Source

2026 ghostsecurity/skills - AppSec skills for AI coding agents

2022 ghostsecurity/reaper - Live validation proxy for testing web app vulnerabilities

2020 OpenCSPM - Graph-based cloud security posture management engine for AWS, Google Cloud, and Kubernetes

darkbitio/gcp-iam-role-permissions - Continuously updated export of all GCP IAM roles and their permissions

Certifications

2020-2024 Google Cloud Certified Fellow: Hybrid Multicloud (program retired)

2020 Certified Kubernetes Security Specialist Exam Developer

2019-2021 Google Cloud Certified Professional Cloud Architect

2007-2016 Certified Information System Security Professional (CISSP), ISC2

2004-2006 RedHat Enterprise Linux Certified Engineer (RHCE), RHEL 3.0

Education

1998-2002 BBA, Computer Information Systems, James Madison University, VA, USA.

Interests

Hockey, Formula 1™, Cloud/Kubernetes Vulnerability Hunting, running local LLMs, Mexican food, and collecting e-books