Operator background. Independent practice.

I'm Shane Jones — independent offensive security consultant with over a decade running adversary simulation and penetration testing programs at enterprise scale.

Most recently at TrustedSec as Security Consultant II, I served as the internal GCP subject matter expert, built custom enumeration and exploitation frameworks, and led engagements across network, application, cloud, and social engineering disciplines.

The AI security practice grew out of that work. Adversarial testing of LLM applications uses the same operator mindset as red team engagements — assume the constraints are wrong, look for the gap between policy and implementation, find what produces leverage. I run engagements using promptfoo, Garak, and manual prompt-engineering against live endpoints.

The secure development practice is where the security and engineering sides converge. I've been writing production code for 17+ years, most of that in a professional context. When clients need a system architected, built, or reviewed with security baked in from day one rather than retrofitted at the end, that's the work.

Before TrustedSec: Red Team Consultant at BMO Harris, Security Consultant at Optiv for three years, and Information Security Analyst at JPMorgan Chase where I earned my OSCP and coordinated a global NAC deployment.

I work independently. Direct access, no account managers, clear scope from day one.