Sam Delacroix-Rivera
Senior Security Engineer · Bastion
I find the hole before the internet does. Twelve years across fintech, SaaS, and one unforgettable night at a national rail operator. Currently leading threat detection at Bastion; writing incident notes and the occasional essay below.
Senior Security Engineer
Bastion · Remote (Paris hub)
Lead the threat detection pod. Built the eBPF-based runtime monitor now shipping on 12k production nodes; mean time to detect down from 11 minutes to 40 seconds.
Security Engineer
Kestrel Payments · San Juan / Remote
Ran fraud-adjacent threat response for a payments rail. The year I stopped being afraid of production, which is the real qualification for this job.
Systems Administrator → SOC
RFFI Transport · Paris
Started in systems, moved to the SOC, and spent one night rerouting a cascading failure across three regions with a coffee and a prayer. The prayer worked (the coffee probably did).
The credential-stuffing wave that wasn’t credential stuffing — what 40k accounts taught us about our own auth logs.
ClosedA supply chain, compromised politely — dissecting a slow-burn dependency attack with a full timeline.
ClosedPostmortem: the night the queue ate the alerts — a queueing bug that silenced detection for nine hours.
ClosedDisclosing a parser bug to a vendor who didn’t want it — the diplomacy of responsible disclosure.
Disclosed