Jon Simmons
I build automation tools, scripts, and systems with a focus on reliability, security, and practical engineering outcomes.
Automation & Scripting
Python, Bash, and Go tooling that eliminates repetitive work
Security-First Thinking
Offensive research and defensive engineering practices
Systems & Tooling
Infrastructure monitoring, CI/CD, and reliable deployments
What I Do
I build tools that turn manual, error-prone workflows into reliable, repeatable processes. If something can be scripted, it should be.
- Custom CLI tools for internal operations and security workflows
- Data pipelines and ETL scripts for monitoring and alerting
- CI/CD integration and deployment automation
I approach security from both sides — building systems that are hard to break, and actively testing systems to find what others miss.
- Web application penetration testing and vulnerability research
- Bug bounty hunting on HackerOne and Bugcrowd platforms
- Security-focused code review and threat modeling
Active on TryHackMe and HackTheBox for continuous skill development.
Featured Projects
View all projectsManual ticket triage consumed hours every week, leading to slow response times and inconsistent categorization across the support team.
Saved ~4 hours per week in manual triage effort
Managing a growing home lab meant constantly SSH-ing into different machines to check system health, with no unified view of resource usage or alerts.
Monitors 12 systems with < 1% resource overhead
Bug bounty recon generated scattered notes across text files, browser tabs, and terminal history, making it difficult to track findings across targets.
Reduced context-switching overhead by ~60% during active recon
Latest Writeups
View all writeupsA walkthrough of the HackTheBox Keeper machine covering initial enumeration, exploiting default credentials in Request Tracker, and leveraging a KeePass memory dump for privilege escalation.
A breakdown of the most common access control failures encountered during security assessments, from IDOR vulnerabilities to missing function-level authorization checks.
How I built a modular Python pipeline to automate the repetitive parts of bug bounty reconnaissance while keeping the manual analysis where it matters most.
Interested in working together or discussing a role?
I'm always open to conversations about security engineering, automation, or interesting technical challenges.