# Derik Callahan

> Senior Manager, IT Security — Security Engineering & Operations, based in Phoenix Metro, Arizona. Security leader working where security operations meets AI. Focus areas: AI risk & agentic security; Cyber operations & threat management; Zero Trust, identity & SSE modernization. CISSP, CISM, AAISM.

Every page on this site has a Markdown twin at the same path with `.md` appended. An MCP server is available at https://derikcallahan.com/api/mcp.

## Profile

- [Home](https://derikcallahan.com/index.md): who I am, how I lead, projects
- [Resume](https://derikcallahan.com/resume.md): full experience, certifications, education, skills
- [Resume (JSON Resume)](https://derikcallahan.com/resume.json): structured resume data
- [For agents](https://derikcallahan.com/agents.md): machine interfaces and MCP configuration

## Writing

- [A resume for two audiences](https://derikcallahan.com/writing/a-resume-for-two-audiences.md): More and more, the first reader of a resume is an AI agent. So I built this site to be read by both people and agents — Markdown twins, llms.txt, JSON Resume, content negotiation, and a small read-only MCP server.
- [The agent is an identity](https://derikcallahan.com/writing/the-agent-is-an-identity.md): Most AI risk conversations start with the model. I think they should start with the credentials. An agent can only do what its identity allows — so govern the identity.
- [Agent traces are security telemetry](https://derikcallahan.com/writing/agent-traces-are-security-telemetry.md): If you can't replay what an agent saw, decided, and did, you can't investigate it. OpenTelemetry already gives us the format. The SOC needs to treat it like EDR data.
- [An agent for apps without APIs](https://derikcallahan.com/writing/an-agent-for-apps-without-apis.md): Every identity program has a list of disconnected applications that someone provisions by hand. I built a proof of concept where a model drives the browser instead — with a human approving every write and a hashed screenshot behind every step.
- [Three gates for an offensive agent](https://derikcallahan.com/writing/three-gates-for-an-offensive-agent.md): I built an MCP server for HackerOne and a bug bounty pipeline around it. The interesting part isn't the 174 tools. It's the three places where the agent has to stop and wait for me.

## Optional

- [Everything in one file](https://derikcallahan.com/llms-full.txt)
- [RSS](https://derikcallahan.com/rss.xml)