Andy Yaro

Cybersecurity engineering student at George Mason University, working on cloud security and on tools that make AI agents show their evidence.

Arlington, VA

Looking ForA Summer 2027 internship in security engineering, cloud security or infrastructure.

About

I'm a cybersecurity engineering student at George Mason University. I like security you can prove: least-privilege AWS designs, tests that pin trust boundaries in place, and tools that make AI coding agents show their evidence before anything lands.
I hold the AWS Certified Security – Specialty, my team won the National AGA Datathon in 2026, and I've taught Python labs and math recitations to 170+ students. I speak French natively and English fluently.

Education

B.S. Cybersecurity Engineering
George Mason University
College of Engineering and Computing · Honors College
Aug 2024 – Dec 2028 (expected)
MinorData Science
GPA4.0 / 4.0
HonorsDean's List every semester, Fall 2024 – Spring 2026Honors College

Experience

Sole developer, bidding platform
CERFODES
Jul 2026 – Present
Building a bilingual bidding platform for CERFODES
See the Record
Undergraduate Counselor, Chip Camp
George Mason University × Micron
Jul 20–22, 2026
Future City Fellow
DiscoverE × UL Research Institutes, with the City of Fairfax
Feb – Oct 2026
Built EV-SIENT, the decision-support model and its platform
See the Record
Learning Assistant
George Mason University
Aug 2025 – Present
Recitations for 90+ students
Teaching Assistant
George Mason University
Aug – Dec 2025
Python labs for 80 students
Research Intern, Cloud Computing
InternPass (remote)
Jun – Jul 2025
See the Record

Certifications

AWS Certified Security – Specialty
Advanced · Issued Nov 5, 2025
Verify on Credly: AWS Certified Security – Specialty (opens in a new tab)
AWS Certified AI Practitioner
Foundational · Issued May 20, 2025
Verify on Credly: AWS Certified AI Practitioner (opens in a new tab)
AWS Certified Cloud Practitioner
Foundational · Issued May 17, 2025
Verify on Credly: AWS Certified Cloud Practitioner (opens in a new tab)

Attacking and Defending AWS
TryHackMe · Issued Oct 6, 2025
Verify on TryHackMe: Attacking and Defending AWS (opens in a new tab)
Advanced DuckyScript
Hak5 · Issued Feb 12, 2025
Verify on Hak5: Advanced DuckyScript (opens in a new tab)
Foundations of Cybersecurity
Google (Coursera) · Issued Dec 21, 2024
Verify on Coursera: Foundations of Cybersecurity (opens in a new tab)

AWS Certified DevOps Engineer – Professional
In progress: studying

Awards

1st place, National AGA Datathon 2026
Team Fiscal Patriots (five students), George Mason University. Final presented Feb 18, 2026 at AGA's National Leadership Training, Washington, D.C. Andy built and presented the team's public site.
Read the Story (opens in a new tab)See the Record
2026 Future City Fellow
DiscoverE and UL Research Institutes. Built EV-SIENT, the team's EV-charging decision-support model and its platform.
Read the Story (opens in a new tab)See the Record

Research

Memory Forensics and Distributed Controls against Malicious USB HID Attacks
Research proposal · Fall 2025
HNRS 302, Honors College, George Mason University
A two-phase study design on Windows 10 and 11: live memory-forensics detection of BadUSB artifacts (Volatility, the Duck Hunt indicators), then three lightweight USB-layer controls tested against a scripted USB Rubber Ducky credential-theft attack.

Contact

Records

Nineteen projects, one record each: the liner notes, the film and the links, as a plain list. The room has the shelves and the turntable.

Data for the Public
EV-SIENT
Planning safe, code-responsive public EV charging
FilmTechnical Deck
What it is
A decision-support model and planner for public EV charging
The problem
Every city wants more EV chargers, but few can show where the first ones should go, and why.
What he built
EV-SIENT ranks twelve public sites in Northern Virginia, and runs the same model on your own sites, right in your browser.
The Method
Score sites on four weighted parts
Size ports and simulate waits
Reweight the model 2,000 times
Run it on your own sites
The number
2,000reweightings of the model, to show how sure each rank is
Role
Built the model and its platform
Stack
Python, queueing and discrete-event simulation, in-browser planner
Year
2026
Team
Five George Mason students, 2026 Future City Fellowship
AI Agents & Tools
Provalume
Evidence-based memory for AI coding agents
FilmTechnical Deck
What it is
Open-source, evidence-based memory for AI coding agents
The problem
Coding agents forget what failed, and most memory keeps what an agent said, not what was proved.
What he built
Provalume trusts only evidence: a check that passed, a reviewer who wasn’t the author, a commit that landed. 777 tests pass.
The Method
Journal every event, hash-chained
Let agents propose, never promote
Climb five rungs of trust
Warn before a failure repeats
The number
777tests pass
Role
Solo: design, code and releases
Stack
Python, SQLite, hash-chained event journal, MCP server, on PyPI
Year
2026
AI Agents & Tools
Orkestra
Many coding agents. One repo. Nothing lands unreviewed.
FilmTechnical Deck
What it is
A runtime for several coding agents on one repo
The problem
One coding agent at a time is slow, and several at once on one repo is chaos.
What he built
With orkestra, many agents share one repo and nothing lands unreviewed, backed by 557 tests, crash-safe resume and secrets redacted from logs.
The Method
Plan the work with a director
Run each task in its own worktree
Let your tests referee
Have a different agent review
The number
557tests; crash-safe resume; secrets redacted
Role
Solo, 17 releases
Stack
Python, asyncio, SQLite, Git worktrees, on PyPI
Year
2026
Data for the Public
Audits Made Simple
Federal spending and audit data, made understandable
FilmTechnical Deck
What it is
A plain-language site for federal spending and audit data
The problem
Federal spending and audit findings are public, but split across three databases, in auditors’ language.
What he built
AuditsMadeSimple maps $8.58 trillion in federal assistance for anyone to explore, and won first place nationally.
The Method
Link three databases by one ID
Score audit health from 0 to 100
Map where the money goes
Explain audit terms in plain words
The number
1stplace nationally, AGA Datathon 2026
Role
Product Developer, site and appendix
Stack
Tableau Public embeds, HTML, CSS, JavaScript, AWS S3, CloudFront
Year
2025–26
Team
Fiscal Patriots, five George Mason students, AGA Datathon 2026
Security & Cloud
Secure Data Hub
Multi-account AWS architecture for client PII
FilmTechnical Deck
What it is
A multi-account AWS architecture for sensitive client data
The problem
In most apps, one stolen credential opens every client’s record.
What he built
With Secure Data Hub, breaking into the app gives no direct read of the tables, and 51 passing tests pin its trust boundaries in place.
The Method
Give the app no direct data access
Assume a narrow role for each read
Take tenant IDs from verified tokens
Encrypt each record with KMS
The number
51passing tests pin the trust boundaries in place
Role
Designed and deployed, solo
Stack
AWS STS, KMS, Cognito, API Gateway, Lambda, DynamoDB
Year
2025
AI Agents & Tools
Tableau Public Authoring MCP
Declarative specs, compiled into Tableau workbooks
FilmTechnical Deck
What it is
An MCP server that compiles specs into Tableau workbooks
The problem
Tableau Public has no publishing API, and no official library builds workbooks from scratch.
What he built
Tableau Public Authoring MCP builds and publishes them anyway. 507 tests pass without Tableau, and 15 more drive the real app.
The Method
Describe a workbook in JSON
Compile it, with Hyper extracts
Open it in Tableau, check for errors
Publish through Tableau’s save flow
The number
507tests without Tableau, 15 more against the real app
Role
Solo, built with Claude Code agents
Stack
Python, MCP, Hyper extracts, macOS automation of Tableau Public
Year
2026
AI Agents & Tools
Local AI Orchestrator
Seven local agents, deterministic validators, no paid APIs
FilmTechnical Deck
What it is
A private multi-agent pipeline that runs on your Mac
The problem
A small model will happily mark its own homework as a pass.
What he built
Local AI Orchestrator runs seven local agents, and in its main pipeline plain-code checks override the judge’s score. No paid APIs.
The Method
Sharpen the goal, pick a path
Draft, then have another agent judge
Check the result in plain code
Critique, fix and try again
The number
227tests, the fifty-word bug included
Role
Solo, with Claude Code for version 2
Stack
Python, Ollama (qwen2.5:14b, llama3.1:8b), Streamlit, LangGraph
Year
2026
AI Agents & Tools
MCP Keynote
Keynote decks, built from one declarative spec
FilmTechnical Deck
What it is
A Keynote MCP server that builds decks from one spec
The problem
Twenty Keynote slides, built one element at a time, took 81 tool calls.
What he built
The rebuilt server builds the whole deck from one spec, in one call. Of its 61 tools, 58 are verified on a real Keynote.
The Method
Write one spec for the whole deck
Check it before anything is built
Build native tables and charts
Read the deck back into the spec
The number
58of its 61 tools verified on a real Keynote
Role
Rebuilt a fork with Claude Code
Stack
Python, MCP, injection-safe AppleScript
Year
2026
Based On
ByAxe’s keynote-mcp, a fork of easychen’s original
Security & Cloud
Summer Research '25
RKE2 on EC2, plus a serverless photo checker
FilmTechnical Deck
What it is
A Kubernetes cluster on AWS, plus a serverless photo checker
The problem
A small Python app, two bare servers on AWS, and no cluster yet.
What he built
Over five weeks, that became a two-node RKE2 cluster on EC2 running the app, and two merged pull requests with code in the team repo.
The Method
Bring up RKE2 on two EC2 nodes
Install cert-manager and Rancher
Containerize and deploy the app
Add a serverless photo checker
The number
2merged pull requests with code in the team repo
Role
Research intern, InternPass (remote)
Stack
AWS EC2, RKE2, Helm, Rancher, Docker, Lambda, Rekognition, Terraform
Year
2025
Based On
The RKE2 quick-start guide, and an AWS example for the photo checker
Security & Cloud
Cloud Resume Extended
A serverless portfolio on multi-account AWS
FilmTechnical Deck
What it is
A serverless portfolio site on multi-account AWS
The problem
The Cloud Resume Challenge asks for one web page and a visitor counter.
What he built
This one was built like production, and the live page matches the repo, byte for byte.
The Method
Split it across four AWS accounts
Sign DNS, serve via CloudFront
Build the counter API in Terraform
Chain deploys with GitHub Actions
The number
18Terraform resources build the counter API
Role
Solo
Stack
AWS Organizations, Route 53, CloudFront, S3, Lambda, DynamoDB, Terraform
Year
2025
Security & Cloud
CERFODES
Intelligent opportunity and proposal management platform
Film
What it is
A bilingual platform for finding tenders and building bids
The problem
Tenders are found and bid files built by hand, across many sites, in French and English.
What he built
CERFODES reads the notices and pre-fills the bid files. You confirm instead of retyping, and a person always decides.
The Method
Gather notices from followed sites
Score how well each one fits
Turn it into a pre-filled bid file
Let a named person decide
The number
30+architecture decision records
Role
Sole developer
Stack
Docker Compose, PostgreSQL with pgvector, Caddy, ClamAV, passkeys
Year
2026–
Built For
CERFODES, ongoing since July 2026: 217 commits so far
- Open in the Room
- Watch the Film
Data for the Public
Outbreak Detective
Work backwards from data to the hidden numbers
FilmTechnical Deck
What it is
An interactive modeling lab for high-school data science
The problem
High-school students rarely get to work backwards from real outbreak data to the numbers behind it.
What he built
Outbreak Detective gives them seven cases to practice on, free and entirely in the browser, with no logins.
The Method
Build a model
Simulate it
Fit it to real data
Compare with a neural network’s fit
The number
7cases, one skill
Role
Design and development
Stack
JavaScript, in-browser models, static site on AWS
Year
2026
Research Basis
Dr. Padmanabhan Seshaiyer’s epidemic-modeling work, George Mason University
Data for the Public
Sealed Forecast
A sealed, pre-registered company-outcome forecast
FilmTechnical Deck
What it is
A filing screen and a sealed company forecast
The problem
Companies tell investors the rules behind their numbers, but does the data agree?
What he built
Sealed Forecast set its bar in advance. No claim cleared it, and the results page says so. Three of four sealed forecasts held the 2.31% outcome.
The Method
Seal a forecast before the deadline
Read 12,406 sentences in 13 filings
Flag 133 candidate rules
Pair two with a public series
The number
12,406sentences read; no claim cleared the bar, and the page says so
Role
Sole author, AI-assisted
Stack
Python, SEC filings, CRPS forecast evaluation
Year
2026
Event
Longaeva AI Hackathon, Fall 2026
AI Agents & Tools
Afterward
Estate paperwork, prepared by a team of agents
FilmTechnical Deck
What it is
A team of AI agents that prepares estate paperwork
The problem
When someone dies, the family inherits the paperwork: Social Security, the IRS, the bank, each with its own forms.
What he built
Upload one death certificate and get page 1 of IRS Forms 1310 and 56 filled, plus a dossier in English and French.
The Method
Read the certificate with Nova Pro
Mask the Social Security number
Run three specialists at once
Fill the forms, bind the dossier
The number
58tests pass
Role
Solo, built with Claude Code
Stack
AWS Strands Agents, Amazon Bedrock (Nova Pro, Nova 2 Lite), Python
Year
2026
Event
AWS Agents for Humans hackathon
Security & Cloud
redteam.log
Red-teaming AI agents. Every prompt logged.
Liner Notes
What it is
A working log of AI-agent red-teaming competitions
The problem
Tool-using AI agents have guardrails, and competitions test where they hold and where helpfulness leaks.
What he built
Every prompt and response is recorded word for word, failures included.
The Method
Try prompt injection
Probe tool-call boundaries
Find where guardrails hold
Role
Solo competitor
Stack
Prompt injection, tool-call boundary testing
Year
2026
Event
CrowdStrike’s Agents of Chaos, huntr’s Inside Job
Private until the competitions' disclosure embargoes lapse.
- Open in the Room
Creative & Culture
Dinia
The Royal Court of Tiébélé, in 3D
Liner Notes
What it is
The Royal Court of Tiébélé, in interactive 3D
The problem
The painted walls of the Royal Court of Tiébélé carry meanings that are hard to find in one place.
What he built
In Dinia, tapping a painted Kassena motif shows its meaning, each tied to a published source and page.
The Method
Gather 790 photos, each credited
Map the site plan and rooms
Catalog 34 named motifs
Tag every claim by its evidence
The number
34named motifs, each with its sources
Role
Solo
Stack
3D on the web, Python research pipeline
Year
2026
Heritage Site
Tiébélé, Burkina Faso; UNESCO World Heritage, inscribed 2024
Private: it uses third-party images.
- Open in the Room
Creative & Culture
Loophole
Where real AI learns, cheats, fails and improves
Liner Notes
What it is
A browser lab where real AI learns, cheats, fails and improves
The problem
Machine learning makes sense once you watch it fail in surprising, specific ways.
What he built
Planned experiments: a fly learns the piano, and a cleaning robot farms points by dropping and re-collecting trash.
The Method
Change the rewards
Break the rules
Watch what the machine does next
Role
Solo
Stack
In-browser machine learning (planned)
Year
2026
In planning: feasibility spikes done, no production code yet.
- Open in the Room
Security & Cloud
NFC Cartridges
Songs on an NFC sticker. Tap to play.
FilmTechnical Deck
What it is
A Flipper Zero app that stores songs on NFC stickers
The problem
A cheap NTAG215 sticker holds 504 bytes, and that’s room for a whole song.
What he built
NFC Cartridges burns a tune onto a sticker in under two seconds, as a standard record that phones should read too.
The Method
Pick a song, hold up a blank sticker
Burn it page by page, length last
Read it back and check every byte
Tap it to play it off the sticker
The number
504bytes per sticker
Role
Solo
Stack
Flipper Zero app in C, NFC NDEF records, NTAG213/215/216
Year
2026
Creative & Culture
Olympus
The 5v5 basketball tournament in Ouagadougou
Liner Notes
What it is
Films, flyers and a website for a basketball tournament
The problem
A 5v5 basketball tournament in Ouagadougou needed to look like the big leagues.
What he built
The tournament got a 23-second announcement film, a 20-second spot cut to the music, gameday flyers and a website.
The Process
Make the film in Blender and Resolve
Cut a spot to the music
Design the gameday flyers
Build the website in Framer
Role
Film, motion design, flyers and website
Stack
Blender, DaVinci Resolve, Framer
Year
2026
Built For
Olympus Africa, Ouagadougou, Burkina Faso
- Open in the Room