About

Experience

Founder, AdminLess.ai — Singapore, hybrid, team of 6

Aug 2024 to present

Three product eras under one company: FlowGlee, Finance, Legal, plus social-sector builds.

Zero-trust architecture from the first commit: tenant isolation, per-tenant encryption keys, Singapore data residency for PDPA alignment, least-privilege access control. Keys held by the client in their own KMS.
Integrated Abbott Libre continuous glucose monitors, linking live glucose readings to food logging.
React Native, one codebase shipping to both iOS and Android.
Started on off-the-shelf vision models for carb estimation, then moved to a curated food database for materially better accuracy.
Health data handling under PDPA.
Pivoted from type 1 diabetics to fitness once the diabetic market proved too small. Built a ~100-person Telegram community ahead of launch.
Shipped to TestFlight only, never the App Store — beta usage was too thin to justify submission. Killed it. Not live today.
Built a real-time voice pipeline — telephony provider for numbering and call routing, Whisper for speech recognition, migrated text-to-speech to ElevenLabs.
Latency engineering — co-located servers in the region nearest the TTS provider, cached common responses, constrained the dialogue tree so the model did less open-ended generation, capped token budgets, and benchmarked models against each other for response characteristics.
Screened every number against Singapore's Do Not Call registry before dialling.
20 customer discovery interviews; ~1,000 calls placed.
Killed on unit economics. Real-world latency proved jumpier than in testing and scripted conversations read as dry. Not live today.
Designed the retrieval architecture end to end — chunking strategy, index configuration — and built an automated system to search for the best-performing RAG configuration rather than tuning by hand.
Model: Gemini 3.1 Flash, chosen on intelligence-per-cost. Migrated the platform Azure → GCP.
PPIS — a data and AI assistant letting researchers run analysis and formulas by asking questions in natural language. Designed part of the cybersecurity and infrastructure.
SG Assist — an automated CRM letting trainers organise information and run trainings. Collected the data, ran initial outreach, gathered feature specifications and did the initial design.
Raised S$172K in non-dilutive funding across four grants. Wrote every presentation, prepared and submitted all documentation, and ran each process end to end.
Google for Startups Cloud credits, ~US$25,000.

Red Team, EY — Singapore

Sep 2022 to Jan 2024

OT and energy — multiple plants. Worked live plant networks and segmented environments, firewalls and DMZ. Found a real attack path through the plant's printer systems, gaining an entry point.
Financial services — penetration testing and adversary emulation against banks and insurers, under the MAS regulatory framework.
Purple team — not tabletop. Researched APT groups and their TTPs, briefed the blue team on exactly which attacks would be run, then executed them with the blue team aware so detection and response could be observed live.
Designed and built automated Cobalt Strike infrastructure using Terraform on Azure, streamlining red team operations.
Wrote custom binaries in C and C# to bypass and evade antivirus and other security controls.
Developed custom Python and Bash tooling to automate attack simulations and scans.
Active Directory attack chains — Bloodhound, Mimikatz, Hydra, John the Ripper, Gobuster, Burp Suite. Identified high-risk findings including privilege escalation and sensitive data exposure.
Authored report templates and full written reports; briefed organisations on remediation.

Penetration Tester, EY — Singapore

Sep 2021 to Sep 2022

Web application penetration testing, going beyond the OWASP Top 10 — identified and exploited critical and high-severity vulnerabilities.
Mobile application security testing — MOBSF, Frida, Objection, Cycript, APKTool, JD-GUI, Magisk.
Prepared detailed findings reports and presented to stakeholders; client management across cross-functional teams.

Project Lead Developer, Perspective Robotics — Singapore

Jul 2020 to Aug 2021

Led development of a web platform for aircraft technicians operating robots — Figma wireframing through React, Node, JavaScript, HTML, CSS, Bootstrap; backend on MongoDB and Python.
Gained the support and collaboration of Bombardier and ST Engineering. Optimised UI/UX so new technicians could operate the robots with minimal training.

Computer Vision Engineer, SOAR — self-employed, autonomous underwater robots

May 2019 to May 2020

Developed and optimised real-time computer vision for underwater object detection and navigation using OpenCV; improved recognition in low-visibility environments to enable autonomous task completion.
Sensor fusion — integrated IMU, sensor and camera data using Kalman filters to improve AUV navigation accuracy.
Software Team Lead at SUTD SOAR — designed and coded the AUV's control and vision systems.
Placed 7th of 18 teams at the Singapore Autonomous Underwater Vehicle Challenge, ranking among the top teams out of 80 teams in Singapore.

Linux Developer Intern, Bosch — Singapore

May 2019 to Aug 2019

Modified Linux operating systems to meet the organisation's functional and security needs.

Designed and optimised Ubuntu-based operating systems with IoT developers using Bash and C; implemented and maintained Jenkins for continuous integration.
Automated testing with PyTest and unittest. Worked in international teams under SCRUM; presented working prototypes to senior management.

Certifications

Practitioner Certificate in Personal Data Protection Jul 2025 to present Credential ID A-25-07-0252
Certified Red Team Professional (CRTP) Feb 2023 to present Credential ID ADLID6712
Offensive Security Certified Professional (OSCP) Dec 2022 to present
CREST Registered Penetration Tester (CRT) Sep 2022 to present Credential ID 3293848764
CREST Practitioner Security Analyst (CPSA) Sep 2022 to present Credential ID 3293848764
CSA Cyber Essentials certification — passed the Cyber Security Agency of Singapore's assessment. Third-party, verifiable, national authority.

Education

Singapore University of Technology and Design (SUTD) — SUTD Undergraduate Scholarship, awarded for A-level performance. May 2018 to present
Specialised in cybersecurity during my education at SUTD.

Toolset

Toolset: OSINT (theHarvester, Amass, SpiderFoot, Shodan, Google dorks), MITRE ATT&CK, nmap, Zenmap, aircrack-ng, Kali, Cobalt Strike.
Network testing — Nmap, Nessus, Metasploit.