About
I'm Zak. I've spent twenty-plus years building systems that guard things that are never allowed to break — payments, identities, private keys, and other people's secrets. Now I run invariant, where I design and build things to be secure instead of auditing them after the fact. Let me help you build something that holds.
What I do
Most security contracting firms play appsec goalkeeper or auditor: reviewing what you've already built and cataloguing what's wrong with it. invariant works upstream of that, on design and direction. I build things to be secure rather than securing things other people built — architecture decisions, security strategy, the shape of the system before the mistakes get expensive. And when the plan is set, I don't hand over recommendations and leave. I stay to build.
The name is the pitch: an invariant is the property of a system that must remain true no matter what the system does. Finding yours, and making sure it survives contact with reality, is the work.
Background
Before invariant: payments security at Amazon on ISO 20022 bank rails, trust engineering and PKI at LinkedIn, and user-privacy features at Fitbit. In 2017 I joined Coinbase as the first engineer hired to its security team — pitched to my future boss as an engineer who knows security, not another security engineer. I grew to Senior Staff there, built version 4 of the cold storage system, oversaw the initial architecture for what became Coinbase Custody, and led key generation operations. My last role there previewed invariant: an in-house consulting architect for internal products.
Since then I've been the security person founders call early — Director of Security and founding engineer at Skiff (acquired by Notion), security architecture lead at c= (a Block subdivision), and staff security engineer at Postman. Different products, same job: make the guarantees hold.
Selected work
- Coinbase: first engineer hired to the security team (2017), grew to Senior Staff.
- Built cold storage v4, in service through ~2023 — successor to a system Coinbase publicly stated held ~10% of all bitcoin in circulation; during v4's tenure, Messari reported ~11% of the entire crypto market cap in Coinbase custody.
- Initial architecture oversight for Coinbase Custody; key generation operations lead.
- Co-inventor on three patents: US 12,243,057, US 11,943,350, and US 12,250,202. Covered in Wired.
- Final role: in-house consulting architect/advisor for internal products, including hot wallet architecture oversight.
Founding & leadership roles
- Director of Security & founding engineer, Skiff (acquired by Notion): cryptographic primitive & library design, initial backend architecture for Skiff Mail.
- Security architecture lead, c= (Block subdivision).
- Staff security engineer, Postman.
Earlier roles
- Amazon payments security: ISO 20022 / CAMT.053 bank partner integrations.
- LinkedIn trust engineering: internal security tooling, PKI, vendor security reviews.
- Fitbit: user data anonymity and security features.
Research, speaking & community
- DEF CON: "Transcending Cloud Limitations by Obtaining Inner Piece" — original attack research.
- Keynote, Blockchain McGill; organizer, BSides SF (multiple years).
- Upstream security fixes to sudo and OpenSSL.
Education
- Honors BSc, Computer Science (networking & security) — University of Windsor.
- MSc, Digital Privacy & Network Security — Karlstad University, Sweden.
- MMath, Security & Applied Cryptography — University of Waterloo.
fractional security & privacy architecture