Skip to content

AI & Security Engineering · final-semester student

I build security tools, then try to break my own results

Supply-chain defence, phishing detection and vulnerability triage — shipped with tests, CI gates and strict typing, and measured honestly enough to report the number that hurts.

About

Johan David Rodriguez Castro
Bucaramanga, Santander, Colombia (remote-ready)

AI & Security Engineering · final-semester student | Model Training & Evaluation · Detection Engineering · Supply-Chain Security

Final-semester Systems & Software Engineering student (UPB Bucaramanga; expected to graduate in 2026)

I am a final-semester Systems & Software Engineering student at UPB (Bucaramanga, Colombia) with verified C2 English (EF SET), looking for a first remote role in AI and machine learning: training models and, above all, evaluating them properly. My second focus is cybersecurity, where I have applied most of what I have trained. I have trained tabular models (LightGBM, XGBoost), neural networks with TensorFlow/Keras (an SMS classifier at 98.1 % validation accuracy) and, right now, a LoRA adapter on a small language model (Qwen3-1.7B) with my own synthetic dataset, not yet evaluated against the base model. I work in Python and SQL. What I have measured, with its honest number. Phishing URL detector (LightGBM + SHAP): before training, I found two independent label leaks in the PhiUSIIL dataset; with both removed, the model reaches 70.5 % recall at a 1 % false-positive rate against phishing submitted two years later. Vulnerability prioritisation dashboard: I reproduced the 6.1× advantage usually quoted for the EPSS forecaster over CVSS, then froze its scores at five past dates and counted only later exploitation; the effort to reach 80 % coverage drops to 0.5–0.7×. Market system with XGBoost and agents (private repository): walk-forward validation and a gate that blocks live capital until the model clears 55 % accuracy; it scores 52.9 % today, so the gate stays shut. SlopGuard: a guard against slopsquatting, the package names a language model invents and an attacker registers, with 5 detection layers and 2,687 tests. At UPB I have volunteered as a developer and technical support since January 2026: I support the institution's end users, identify and analyse port scans and intrusion attempts on the network, and built, as part of a team, the GOATGuard mobile client (Flutter, TOTP 2FA). In 2025 I was Scrum Master of an academic project on high-availability infrastructure. I am also enrolled in the UPB postgraduate Specialisation in Information Security (in progress).

Let's work together

I'm open to AI/ML and cybersecurity roles, remote-first. Tell me what you're building.

Get in touch →