Lukas Mindaugas C.

AI Automation & Cybersecurity Engineer | Voice Agents, Pentest, vCISO

I do two things, and they turn out to be the same job seen from opposite ends: I build AI systems for businesses, and I break into systems for a living. AUTOMATION AND AI. Voice agents, chatbots and the plumbing around them, mostly for service businesses and e-commerce: things that answer calls, book appointments, reply to customers and move data between systems without someone babysitting it. I worked on the customer side before switching to engineering, so I have been the person the automation was supposed to help. It shows in what I build: my agents have escalation paths, my bots know when to stop talking and hand off to a human, and dashboards show the numbers someone actually asks about on Monday morning. Python/FastAPI and TypeScript backends, Next.js dashboards, Postgres on Supabase, n8n where it is enough and code where it is not. My production voice pipeline sits around 420ms voice-to-voice, because a bot that pauses for two seconds gets talked over and the whole conversation falls apart. CYBERSECURITY. Web application penetration tests (OWASP WSTG, CVSS scored, retest included), external attack surface discovery, phishing programs with the email hardening that actually stops spoofing (DMARC to reject, SPF, MFA, legacy auth off), cloud incident response, and SOC 2 readiness followed by a fractional CISO retainer. Written authorization before the first packet, scope agreed in writing including what is out of it, and findings tied into the attack chain a CEO understands without a glossary. WHY BOTH. Most of what I find in a pentest is something a developer forgot under deadline: a tenant check missing on one endpoint, a role field accepted on a profile update, a webhook URL nobody validated. I have been that developer. It makes me a better tester, and it means the systems I build ship with tenant isolation, audit logs, rate limits and token revocation on day one instead of after the first report. Recent work, all of it in the portfolio below: - Multi-tenant AI receptionist platform built end to end: the voice agent answers, checks a live calendar, books, confirms by SMS and syncs the lead to 15 integrations including HubSpot, Salesforce, Pipedrive and Shopify. Row-level isolation, audit log on every action. - Grey-box pentest of a 340-company SaaS: 13 findings, two critical (cross-tenant invoice access, self-service privilege escalation). Both closed in five days, the frozen deal unblocked. - Read-only AI analyst for an agency running ~170 client ad accounts: 45 tools over live APIs, with a regression suite that catches invented numbers before staff see them. - External attack surface review for a three-brand e-commerce group: 187 DNS records, and a staging shop serving 61k real customer records with no password. Offline in 40 minutes; monthly monitoring since. - Cloud incident: a cryptominer in an agency's AWS account, root cause in 8 hours (an admin key sitting in a public repo for eight months), clean rebuild in 48 with zero downtime. - Inventory agent that reads three years of accounting exports and turns them into order decisions; the audit alone showed a third of the client's purchasing ran on wrong assumptions. - Phishing program for a 60-person law firm: credential entry from 19% to 4% in eight weeks, reporting from 5% to 48%, DMARC moved to reject without losing a single legitimate email. - SOC 2 readiness for a 22-person SaaS: a 180-question buyer questionnaire answered in four days, deal signed, Type I three months later. HOW I WORK. Deterministic code makes the decisions, AI reads and explains, and anything consequential waits for a human. I do not trust a system until there is a test set proving it works, and I do not write a finding I cannot reproduce on camera. Reports are written for the person who has to fix it and the person who has to sign it, in that order. Logging and alerts go in from day one, including alerts for when something quietly stops. Boring, but it is why my stuff keeps running after I am gone. Not sure whether you need automation, a security review, or both? Message me and describe the situation in a couple of sentences. I will tell you honestly what I would build or test, what it would cost, and what I would not bother with at all.