Aaron Sawit

Security engineer · Singapore

Security engineer with a First Class computer science degree and the GCIH. By day I assess technology risk against government security policy. I also build and test AI systems: a marking system measured against human examiners, open-source guardrail tests, and a suite of free learning tools used by students. Six years of tutoring special needs students taught me to explain hard things simply.

See the work

Experience

Cybersecurity Engineer, GovTech Singapore

2025 to present

Assess the security risk of SaaS and third-party services that government agencies want to adopt, against government ICT security policy (IM8).
Review requests to deviate from policy: weigh the risk, check the compensating controls, and recommend whether to approve, reject or change them.
Point of contact for agencies' security policy questions. I turn policy text into a clear answer that engineers can act on.

AI Engineer (assignment), DART

2025

Rebuilt an early prototype into a working AI marking system for the group's bootcamp selection exam: Python, Claude on AWS Bedrock (3.5 Sonnet, later Sonnet 4), versioned prompt templates, and parallel marking of a full intake from a spreadsheet.
Wrote the evaluation harness that scores the model against instructor marking, and used it to drive every prompt change: agreement rose from about 60% to about 77%.
Used it on past papers and live applicants, several hundred scripts in all.

Cybersecurity Specialist, Red Alpha Cybersecurity

2024

Full-time blue team and red team training programme (the Alpha Specialist Training Bootcamp).
Earned the GIAC Certified Incident Handler (GCIH) through SANS SEC504 and completed the Hack The Box SOC Analyst path.

Private Tutor, self-employed

2020 to present

One-to-one tutoring for primary and lower-secondary special needs students, referred by a specialist from the Dyslexia Association of Singapore. The reason the Versed tools exist: I build what my own students need and keep it free.

Full-time National Service, Singapore Armed Forces

2018 to 2020

Skills

Risk and governance: Third-party and SaaS security risk assessment, policy deviation review, compensating controls, government ICT security policy (IM8), NIST CSF, ISO 27001
AI engineering and AI security: LLM applications on AWS Bedrock and Cloudflare Workers AI, prompt evaluation against human marking, prompt-injection regression tests, model file integrity checks, cost and rate caps in code
Detection and response: Sigma rules mapped to MITRE ATT&CK, Elastic Stack and Splunk, Sysmon and Windows event logs, incident handling (SANS SEC504), Wireshark, Nmap, YARA, Snort
Cloud and application: AWS Bedrock and IAM, Cloudflare Workers, Durable Objects, D1, KV and Pages, TypeScript, authentication and sessions, rate limiting, CSP and security headers
Infrastructure: Linux, Docker and Compose, systemd, iptables, WireGuard and Tailscale, DNS filtering, backups and monitoring
Programming: Python, TypeScript and JavaScript, shell

Selected work

Versed

Product suite, solo · 2026, ongoing

Four free learning tools for students, tutors and teachers. I design, build and run all of them myself, on Cloudflare's edge. No sign-up to play, no tracking, and no budget.
4 products live · no sign-up, no tracking · 1 person: design, code, ops

Detection tooling

Blue team, Python · 2024 to 2025

Small, tested tools from my blue team practice: a log triage pipeline that pairs rule-based detection with an LLM classifier, a phishing link checker, and Snort and iptables rules I wrote by hand.
10 Sigma rules across 15 ATT&CK techniques, green in CI · 12 public repositories with passing builds

Open-source AI security tools

Python and Cloudflare Workers AI, open source · 2026

Prompt-injection regression tests with deterministic grading, a bit-level audit of a model file against its claimed base, a probe for real tool calling, and Break my bot, a six-level game on this site about why telling an AI to keep a secret is not a security control.
20 attack patterns, no judge model · found 90 edited rows in 151,936 on a tampered model · tests and CI throughout

Training and certification

GIAC Certified Incident Handler (GCIH)

SANS SEC504: Hacker Tools, Techniques and Incident Handling

CSIT TISC CTF

National capture-the-flag. In 2026, the year AI tools were allowed, cleared four of ten levels in a single day.