Danny Pham Huu Danh

Security leader who builds and breaks. 9+ years across offensive security, operations, and engineering. Now Security Manager and head of security at Galaxy FinX, leading security and corporate IT and partnering with DevOps, SRE and business teams to modernize without slowing delivery. Before that, head of IT security (Assistant Vice President) at a regulated bank, where I built an AI-assisted security operation: AI agents worked under human control, so a lean team ran the full security program while people kept ownership of every judgment and risk decision. I also build the tooling I run, in Go, Rust, and Python: open-source security-as-code command-line tools that AI agents can drive over MCP, a citable corpus of Vietnamese law (in development), and aboutme.vn, a free resume builder for Vietnamese and English.

Head of security, leading security and IT engineering and partnering with DevOps, SRE and business teams. Set priorities across security architecture, engineering and operations, balancing risk, delivery, cost and operational continuity.

• Security leadership: Translate business priorities and security findings into a phased roadmap. Map systems and dependencies, clarify ownership, and establish standards and runbooks so teams can execute and maintain improvements independently.

• Security engineering: Establish a shared approach for the team’s application and infrastructure security work, covering pipeline controls, whitebox reviews, production assessments and remediation verification. Set review standards and prioritize findings for engineering teams.

• Infrastructure governance: Strengthen existing infrastructure as code by simplifying its structure and addressing control gaps. Clarify ownership, review and approval responsibilities, and rollback procedures so changes are easier to manage and audit.

• Zero-trust transformation: Lead a phased rollout across identity, devices, SaaS and network access, reusing existing platforms and prioritizing investment by risk. Implement initial improvements and guide the team’s continued rollout, including HR-driven access management, stronger authentication and device controls.

• AI-assisted engineering: Improve existing AI workflows for security and engineering through clearer task boundaries, scoped permissions, validation and human review. Keep technical accountability and risk decisions with the responsible people.

• Compliance by design: Translate regulatory and security requirements into architecture decisions, assigned controls and traceable evidence, integrating compliance into engineering delivery.

Head of IT security for a regulated bank. Built a new-generation security operation run by AI agents under human control: a two-person team delivered the full program (operations, offensive security, governance) while people owned every decision. Set strategy, guided the team, and built its security tooling; rated Outstanding, the highest performance tier, in the first year.

• Ran SIEM, SOAR, threat intelligence, EDR, vulnerability management, and network security with AI agents connected to each tool, and 24/7 AI-assisted triage.

• Improved the SAST, SCA, and secrets gates in CI/CD; delivered the bank's first unified security-posture platform for cloud, vulnerability, network, and endpoint findings.

• Directed 10+ AI-assisted penetration-testing campaigns and a supply-chain attack simulation across core-banking, internal, and customer-facing systems; reported exploitable risk, remediation roadmaps, and compensating controls to the CTO.

• Defined offensive methods: whitebox in the DevSecOps pipeline, validated against the live deployment for honest severity and exploit chains; blackbox captured as reviewed, versioned playbooks for safe reuse; a network-isolated AI pipeline proposed candidate attack chains for analyst review.

• Owned the IT security roadmap and monthly posture reporting to the CIMB group; led information-system security classification and NIST CSF 2.0 / CIS alignment; contributed to the State Bank of Vietnam regulatory dossier.

• Made agent-written incident investigations double as the audit and compliance artifact, mapping findings to Vietnamese and Malaysian banking regulation.

Security operations for a Web3 gaming platform handling high-value digital assets.

• Ran detection and incident response across endpoints and cloud — custom detection rules, malware analysis, and SOAR-automated response and case management.

• Security-reviewed third-party game builds before release on Mavis Hub — manual reverse engineering combined with automated scanning tooling.

• Delivered Web2/Web3 security-awareness training (wallet and seed-phrase protection).

• Triaged alerts across Cortex XDR, SentinelOne, Cato Networks MDR, and Code42 DLP, correlating endpoint, network, and data-loss signals to escalate incidents.

• Partnered with IT on endpoint compliance — CIS-baseline checks via Qualys Policy Compliance, with posture enforced through Intune (Windows) and Kandji (macOS).

• Built an internal asset-management system that consolidated scattered device and software inventory into a single source of truth for security and IT operations.

• Conducted red-team engagements simulating APT-level TTPs — network, phishing, wireless, and physical security assessments.

• Ran continuous red-team and purple-team programs with client blue teams to improve detection and response.

• Found and responsibly disclosed an account-takeover exploit chain in Zalo and ZaloPay (platforms serving 100M+ users).

• Contributed to VinCSS COTIP, a threat-intelligence platform aggregating 1,500+ domestic and international news sources.

• Researched Windows kernel and user-mode vulnerabilities and wrote custom C/C++ exploits to bypass endpoint security controls.

• Built modular Python red-team frameworks and post-exploitation tooling spanning initial access, privilege escalation, lateral movement, persistence, and evasion.

Python · SIEM/SOAR as code

Python CLI and MCP server for Splunk Enterprise, Enterprise Security and Splunk SOAR, published on PyPI: SPL search, notable triage, detection rules as YAML, SOAR cases and playbooks, and configuration drift with change-evidence reports. Every remote change is a dry run until --yes.

Go · SIEM/SOAR as code

Go CLI and SDK for Google SecOps (Chronicle SIEM, Siemplify SOAR): pull, diff and push detection rules, parsers, dashboards and playbooks, plus UDM and Gemini search and case triage. Built-in MCP server; every mutation is a dry run until --yes.

Rust · SIEM as code

Rust CLI and MCP server for Elastic Security on self-managed, Cloud Hosted and Serverless: pull, diff and push detection rules with change-evidence reports, and manage data views, dashboards and Fleet policies as files. Also alert and case triage. Every remote change is a dry run until --yes.

Go · EDR as code

Go CLI and SDK for the SentinelOne Singularity Platform: pull, diff and push 11 configuration surfaces, with a drift command for CI. Also covers agents, threats, xSPM posture, cloud rules and Data Lake PowerQuery searches. Built-in MCP server.

Go · Nuxt · PostgreSQL · live product

Free, open-source resume builder for Vietnamese and English, live at aboutme.vn since October 2026 (this resume runs on it). Twenty templates, per-resume publishing with public links and PDF export, passkey and authenticator second factors, and MCP access for AI assistants that can edit but never publish.

Go · MCP server · in development

Citable corpus of Vietnamese law for AI agents over MCP and for people on the web. Evidence only: verbatim provisions with citations, validity and amendment context, organized in a subject tree so agents narrow before they search. Successor to banhmi, my earlier evidence-only regulation server for six ASEAN jurisdictions.

Go · cloud SDK and CLI

Unofficial Go SDK and command-line tool for GreenNode (formerly VNG Cloud): budgets and spend alerts, price quotes, infrastructure reads and uptime checks, with JSON output and read-only profiles for AI agents.

GPA: 8.15/10. Thesis on bypassing endpoint security via vulnerable Windows drivers (BYOVD); first-authored the resulting paper (Springer FDSE 2021).

GPA: 8.53/10. Thesis on static PE malware detection using machine learning; first-authored the resulting paper (Springer FDSE 2018).

Static malware detection on Portable Executable (PE) files with gradient boosting decision trees. Cut training time by reducing feature dimensions and reached a 99.394% detection rate at a 1% false positive rate. Cited 51 times.

Demonstrated Bring Your Own Vulnerable Driver (BYOVD): a legitimately signed but vulnerable driver (Intel Network Adapter Diagnostic Driver, 2012 version) used to dump credentials while evading antivirus and EDR detection.

Web privacy protection that monitors JavaScript behavior by code origin instead of intercepting network requests. Cited 11 times.

NIST CSF 2.0, ISO/IEC 27001, PCI DSS v4.0.1, State Bank of Vietnam regulation, CIS Benchmarks, Zero Trust, security architecture review, C4 modeling, threat modeling, regulatory compliance, third-party risk management, IT & cloud due diligence, security audit, security policy

Google SecOps, Splunk, Elastic Security, CrowdStrike Falcon XDR, Cortex XDR/XSOAR, SentinelOne, Tenable Nessus, Qualys, DevSecOps pipelines (SAST, SCA, secrets scanning), DefectDojo, AWS, Google Cloud Platform (GCP), Terraform, Terragrunt, HCP Terraform, Kubernetes (EKS), Argo CD, GitHub Actions, HashiCorp Vault, Docker

Red Teaming, Penetration Testing, Whitebox Code Review, Exploit Development, Threat Hunting, Incident Response, Malware Analysis, Digital Forensics, Windows Internals, MITRE ATT&CK

Python, Go, Rust, C/C++, C#, TypeScript, PowerShell, Django, Temporal, PostgreSQL, MySQL, MongoDB, Elasticsearch, Vertex AI, RAG, MCP servers, LLM agents