{ "basics": { "name": "Javier Flores", "label": "AI and Cybersecurity Engineer", "email": "javflores.ct@gmail.com", "location": { "city": "Glastonbury", "region": "CT", "countryCode": "US" }, "profiles": [ { "network": "LinkedIn", "username": "javierrflores", "url": "https://www.linkedin.com/in/javierrflores" } ], "summary": "I'm an AI engineer at Beacon Industries, a defense manufacturer in Connecticut, where I'm also the IT engineer and cybersecurity manager. My main work is end to end AI and software projects, from the first customer conversation to production, including machine learning models. I also own CMMC and NIST SP 800-171 control implementation. I co-founded NJ Developments, a web and AI agency, and I'm finishing an MS in Cybersecurity at Quinnipiac." }, "work": [ { "name": "Beacon Industries", "position": "AI Engineer, also IT Engineer and Cybersecurity Manager", "location": "Newington, CT", "startDate": "2026-05", "summary": "Defense manufacturer in Newington, CT.", "highlights": [ "Own four AI and software initiatives start to finish, built on RAG, embeddings and agentic workflows with tool calling and structured outputs. I demo the work every week to NASA, U.S. Air Force and U.S. Navy technical and program leaders and turn their feedback into the next release.", "Built an engineering-simulation surrogate model end to end, from simulation-data preparation through model development and evaluation, and presented the finished work.", "Write the services myself in Python and TypeScript: React front ends, FastAPI and Node APIs, SQL/PostgreSQL and Firebase behind them, and the integrations that put real enterprise data in front of the model.", "Led readiness for a successful DoD DIBCAC assessment with the ISSO and assessment team: updated the SSP, wrote and reviewed policies and procedures, drove remediation and walked the government auditors through the evidence.", "Own CMMC and NIST SP 800-171 control implementation: the risk assessment, the identity, endpoint and network changes that satisfy each control, and the evidence that proves it at audit.", "Cleared the enterprise vulnerability backlog, criticals first, with scripted remediation, patching, policy changes and compensating controls on legacy equipment that can't be patched. Built monitoring in Python, PowerShell, Intune and Defender XDR that catches recurring vulnerabilities and configuration drift.", "One direct report. I give technical direction to the offshore offices and work directly with the ISSO and the Software Chief." ] }, { "name": "NJ Developments", "position": "Co-founder, Technical Lead", "location": "Connecticut", "url": "https://nj-developments.com", "startDate": "2022-01", "endDate": "2026-06", "summary": "Web and AI agency for Connecticut service businesses.", "highlights": [ "Co-founded the company with two partners. Led engineering and also handled outreach, discovery, proposals, pricing, demos and support across a seven-client portfolio.", "Delivered 30+ production sites and applications supporting 1,000+ users. Hand-coded, mobile-first HTML, CSS and JavaScript on Firebase by default, and WordPress, Wix, Squarespace or Elementor when the client was already on one.", "Built and self-hosted an internal AI knowledge assistant over the company's documents and operational data (LLM APIs, RAG, MCP tools), running 24/7 on a Linux VPS.", "Built AI voice agents for 24/7 call answering, plus review and follow-up SMS automation for client lead capture." ] }, { "name": "Access Health CT", "position": "Information Technology Intern", "location": "Hartford, CT", "startDate": "2025-06", "endDate": "2026-05", "highlights": [ "Ran control analysis in RSA Archer against MARSE and ARC AMPE, documented the gaps, tracked remediation and worked the on-site security audits.", "Administered an IT environment of 300+ users, produced evidence for a SOC 2 audit and ran access reviews.", "Scored 9+ asset management platforms through vendor demos, presented the pick to IT, Finance and leadership, and helped lead the reconciliation of 2,000+ hardware assets into one inventory." ] }, { "name": "Connecticut Judicial Branch", "position": "Endpoint Management Intern", "location": "East Hartford, CT", "startDate": "2024-05", "endDate": "2024-08", "highlights": [ "Deployed and secured endpoints statewide with SCCM, Intune, Defender and PowerShell, and packaged and tested applications for the move from SCCM to Intune.", "Wrote the statewide deployment documentation the team worked from. Hunted threats in Defender and triaged alerts." ] }, { "name": "theCoderSchool", "position": "Computer Science Instructor", "location": "Glastonbury, CT", "startDate": "2024-04", "endDate": "2024-08", "highlights": [ "Taught computer science to students ages 8 to 16, one on one and in larger classes." ] } ], "projects": [ { "name": "NIST SP 800-171 score calculator", "status": "Live at javierrflores.com", "url": "https://javierrflores.com/#lab", "description": "Mark requirements as unmet to see an estimated SPRS score, an illustrative CMMC Level 2 status and a POA&M list you can copy. Weights come from the DoD Assessment Methodology and 32 CFR 170. Educational, not an assessment or certification.", "keywords": [ "JavaScript", "DoD Assessment Methodology", "32 CFR 170" ] }, { "name": "Knox", "status": "In daily use", "description": "My personal AI agent. It keeps memory across sessions in plain files, reaches Gmail, Calendar, GitHub and internal APIs through MCP tools, runs scheduled jobs, and talks over real-time voice with cost-based routing between local and frontier models.", "keywords": [ "Python", "Node", "Claude API", "MCP", "Playwright", "systemd", "Linux" ], "detail": [ "The guard is code: a hook runs before every tool call, checks shell commands and protected file writes against a deny list (wiping a disk, raw writes to a drive, killing the session it runs in, overwriting its own global config) and blocks matches outright. It catches known catastrophic patterns. It is not a sandbox.", "The rest is policy: spending money, deleting data and messaging people wait for my explicit OK, and a failed tool call gets reported with its real error instead of guessed around.", "One real run: it bought this site's domain. It found the name, filled the registrar checkout and stopped at the payment step until I picked the payment method and handed it the one-time code from my phone." ] }, { "name": "CBNA member and event platform", "status": "In production", "url": "https://thecbna.org", "description": "Member and event platform for the Connecticut Business Networking Association, built through NJ Developments. I led technical delivery: member and nonmember registration, event payments, QR check-in with duplicate-scan protection, digital membership passes, attendee rosters and CSV exports, and an AI assistant on the public site.", "keywords": [ "Next.js", "Firebase App Hosting", "AI assistant" ] }, { "name": "Evidence validation with specialist agents", "status": "In progress", "description": "Team capstone for my MS in Cybersecurity. Agents that each know one NIST SP 800-171 control family check submitted evidence against the requirement's assessment objectives, and a person makes the call. Write-up and code after December 2026.", "keywords": [ "NIST SP 800-171A", "Agents", "Evaluation" ] }, { "name": "btcv2", "status": "Research", "description": "Trading research platform. A transformer forecasting model plus technical analysis across FX, crypto and equities, with broker API integration and eleven independent risk guards on execution, including drawdown limits, ATR position sizing and permanent safeguards against real-money orders.", "keywords": [ "Python", "MetaTrader 5 API", "CCXT", "pandas" ] }, { "name": "papercheck", "status": "Tool", "description": "Python web app for checking documents in batches, with a forensics module for authorship and integrity analysis.", "keywords": [ "Python" ] } ], "education": [ { "institution": "Quinnipiac University", "studyType": "Master of Science", "area": "Cybersecurity", "endDate": "2027-05", "courses": [ "Cloud security", "Risk management (NIST SP 800-30, 800-39)", "Capstone" ] }, { "institution": "Quinnipiac University", "studyType": "Bachelor of Science", "area": "Computer Science", "endDate": "2026-05", "courses": [ "Minors in Criminal Justice and Management" ] } ], "skills": [ { "name": "Security and GRC", "keywords": [ "CMMC", "NIST SP 800-171", "NIST 800-53", "NIST CSF", "RMF", "CUI", "SSPs and audit evidence", "RSA Archer", "SOC 2 evidence", "Vulnerability management", "Incident response", "Threat hunting" ] }, { "name": "Platforms and cloud", "keywords": [ "Intune", "Entra ID", "Defender XDR", "Purview", "Sentinel", "Microsoft 365", "Azure", "AWS", "Tenable", "UniFi" ] }, { "name": "Applied AI", "keywords": [ "RAG", "Embeddings", "Agents and tool calling", "Structured outputs", "Evaluation", "MCP servers", "Claude", "OpenAI and Azure OpenAI" ] }, { "name": "Software", "keywords": [ "Python", "TypeScript", "PowerShell", "Bash", "SQL", "React", "Node", "FastAPI", "PostgreSQL", "Firebase", "Docker", "HTML and CSS" ] } ], "$schema": "https://raw.githubusercontent.com/jsonresume/resume-schema/v1.0.0/schema.json", "meta": { "lastModified": "2026-10-12" } }