MatthewAllicock

Network security engineer · founder · Toronto, ON

I decide what traffic gets through at a bank. On my own time I find problems worth solving and ship the fix. Least privilege by day, founder by night.

3rolesExperience 2venturesFounder 5+buildsProjects

open to full-time roles · 2027 RBC Cyber Security BIT Networking & IT Security

show access-list PORTFOLIO · evaluated top-down, first match wins

3 zones · 8 rules · 0 any/any

zone experienceemployers · 3 roles
10REVIEWRBC firewall riskcheck point, palo alto · least privilege3,000+ requests→
20SEGMENTOntario Tech University facility networkvlans · acls · unifi · pentest130+ devices→
30SUPPORTOntario Government ITactive directory · entra id · intune150+ users→
zone founderstarted from zero · 2 ventures
40SHIPArcwaynext.js · node · mongodb · whisper200+ interviews→
50ISOLATEBank statement analyzerself-hosted llm · caddy · linux gpu4 h → 30 min→
zone projectsteam builds · case studies
60ENCRYPTClassistantAIcloud kms · aes-256-gcm · oauth 2.02 keys, split rights→
70ROUTEFour-site enterprise WANebgp · ospf · etherchannel · 802.1q4 sites, 5 AS→
80BUILDSmaller buildsflask ci/cd · python · red team3 more→

implicit deny: vague claims, inflated numbersselect a rule to open its case file

Zone · Experience

Experience

employers · 3 roles · 2024–2026

202420252026

Ontario Tech · ACENetwork Eng. · 12 mo Ontario GovIT · 5 mo RBCCyber Security · 12 mo

ExperienceRule 10REVIEW

RBC

Royal Bank of Canada

Firewall risk assessment

Role Cyber Security Analyst (Intern) Jan–Dec 2026 · Toronto, ON

Medium and high risk firewall requests at a major bank come to my desk. I push requesters to narrow access before anything gets approved.

3,000+requests through the team to date

100–200a month I co-own

3+stakeholder teams advised

See how it worksShow less

Assess source and destination scope, port exposure, non-prod to prod paths and data classification against enterprise standards
Document every approve or reject decision so it holds up in an audit
Trace approved rules that fail in production across policy, routing and NAT
Pitched, and now run, the team's weekly ticket-flow metrics: intake, closure rate, turnaround

Check PointPalo AltoAlgoSecOSFI B-13NISTPCI DSS

Change request · illustrative

Source

Destination

Service

Path

Justification

Exposure

Made-up addresses. The pattern is the real one: wide subnets, broad port ranges and dev-to-prod paths get sent back narrower.

ExperienceRule 20SEGMENT

Ontario Tech University

ACE facility · Oshawa

ACE facility network redesign

Role Network Engineering Intern May 2024–Apr 2025 · Oshawa, ON

A live research facility network kept dropping its equipment controllers, and every shutdown cost $20K–$30K. I rebuilt it.

$20–30Kcost of each shutdown it stopped

130+devices monitored

See how it worksShow less

Learned the old switch config, procured new switches, configured and deployed them on Ubiquiti UniFi
VLAN segmentation, ACLs and firewall rules between device groups; OSPF between L3 routers and L2 switches
Ran vulnerability scans and penetration tests on the internal network and web apps I'd just built
A firewall change took the devices offline once. I'd snapshotted first, so I rolled back to known-good and fixed it

UniFiVLANsACLsOSPFNessusNmap

Flat vs. segmented · schematic

Schematic of the idea, not the facility's real layout. These controllers run physical equipment, so this sits closer to industrial network security than office IT.

ExperienceRule 30SUPPORT

Ontario Government

MPBSDP

IT systems, identity & the Windows 11 move

Role IT Systems Officer (Intern) May–Sep 2025 · Toronto, ON

Identity, devices and support for a government ministry during the move from Windows 10 to Windows 11.

150+users supported

100+identities administered

400staff in migration AMAs

See how it worksShow less

Resolved endpoint, VPN, DNS and M365 issues, remote and in person
Administered access across Active Directory, Entra ID and Intune: OUs, permissions, password resets, device issues
Tier 2 support for 40+ senior officials
Co-hosted Ask Me Anything sessions for about 400 staff on the Windows 11 upgrade

Active DirectoryEntra IDIntuneM365VPN

Identity to endpoint · schematic

Schematic of the identity chain I worked across, not the ministry's real topology. Fleet dots are illustrative.

Zone · Founder

Founder

Built from zero

Nobody assigned these. I went looking for a problem, talked to the people who have it, and shipped something they used. Each one starts with the problem, not the stack.

FounderRule 40SHIP

Arcway

Founder / Full-Stack Developer · formerly TalentTempo · 2025–2026

An AI interview practice platform I built and launched with real users. Then I attacked it myself and closed the hole I found.

Problem
Candidates practise interviews blind, with no honest read on how they come across.
Insight
One big prompt drifted. Splitting interviewer and scorer into two agents made feedback consistent.
Build
Voice answers, Whisper transcription, live face, voice and posture scoring.
Result
Launched to real users, then pentested it myself.

30+users

200+AI-conducted interviews

3signals scored live: expression, voice, posture

See how it worksShow less

Candidate speaks answers; Whisper transcribes; an interviewer agent runs the flow and a separate feedback pipeline scores it
Splitting one drifting prompt into two agents fixed most of the inconsistent feedback
bcrypt passwords, httpOnly JWT cookies, server-side tier checks, rate limits: 100 req / 15 min per IP, lockout after 10 failed logins
Docker on Railway, CI/CD with tests before a separate staging and production branch

Next.jsNode / ExpressMongoDBWhisperHume EVIRailway

github.com/MatthewA15/arcway ↗

Arcway · current build

Arcway landing page: Stop guessing. Walk in ready. Beside a feedback screen ranking areas to improve

arcway.app

Broken access control · found & fixed

I intercepted my own app's traffic, edited one field, and a free account unlocked paid features. The server trusted the client. The fix: entitlements come from the stored account record on every request.

FounderRule 50ISOLATE

Bank statement income analyzer

Founder · AI tool for mortgage brokerages · 2026

Brokers told me the barrier to AI wasn't price. It was trust in uploading client bank statements. So I designed the system around where that data goes.

Problem
Brokers rebuild self-employed income from bank statements by hand. About 4 hours a file.
Insight
The blocker was trust in uploading client statements, not price.
Build
A self-hosted model that only categorizes. Code does every sum.
Result
Piloted with brokerages on real files: 4 hours down to 30 minutes.

2–3brokerages piloted

50+real deal files tested

0client files sent to AI model providers

See how it worksShow less

Rebuilds a self-employed borrower's income: net income, expense categories, large-deposit flags, declared vs. derived gap
Open-source model on a rented GPU host, behind a Caddy reverse proxy with an IP allowlist and per-client accounts
Nothing kept by default; with consent, files are wiped after a set retention window
The model never does arithmetic: it only labels each line, and deterministic code sums, so every number traces back to a transaction
Reconciles against the bank's own printed closing totals as a checksum before any AI step runs
Reads TD and BMO layouts by column position, so debits, credits and running balances never get confused
When output disagreed with a broker's manual numbers, I traced the run through logs, fixed and redeployed for retest

Self-hosted LLMLinuxCaddyRunPod GPU

Income reconstruction · sample file

Income reconstruction results for a fictional contractor: working derived income $82,500, coverage and reconciliation walk, and a review queue flagging large e-transfers and the gap versus declared income

fictional client · synthetic data

Precise claim: no client data goes to AI model providers. The GPU host is still a third party, so I don't say "it never leaves our servers."

Zone · Projects

Projects

team builds · case studies · competitions

ProjectRule 60ENCRYPT

ClassistantAI

classistant.ca · Ontario Tech & U of Alberta

Locking down an AI agent's credentials

Role Cloud / Backend Developer Team project · 2026 · Google Cloud

An AI assistant students text, live at classistant.ca for Ontario Tech and University of Alberta. It reads their Gmail, Calendar, Drive and school portal, so the real product is how it guards their credentials.

See how it worksShow less

Built the FastAPI connector service on Cloud Run that turns a stored credential into a live Google API client
Envelope encryption: each credential gets its own AES-256-GCM data key, wrapped by Cloud KMS, with the user ID bound in as authenticated data
Two KMS keys. The connector can only decrypt Google tokens; the browser agent can only decrypt portal passwords. IAM enforces it, not code
The browser agent's model only ever sees a placeholder password. Code swaps in the real one at the tool call and scrubs it after
First named decider on moving credential storage from Secret Manager to Firestore + KMS

Cloud RunCloud KMSFirestoreTerraformFastAPIOAuth 2.0

github.com/MatthewA15/ClassistantAI ↗

classistant.ca · live site

Classistant landing page: Your semester, handled over text, with a phone showing a text reminder that STAT 151 assignment 3 is due Friday

classistant.ca ↗

Who can decrypt what

Green: IAM grants decrypt. Red dashed: denied. One shared key was rejected because any service with decrypt rights could then read school passwords.

ProjectRule 70ROUTE

Four-site WAN

Toronto · Chicago · Mexico · Vancouver

eBGP hub-and-spoke enterprise network

Role Network designer Advanced networking case study · Cisco IOS

Toronto, Chicago, Mexico and Vancouver on one hub-and-spoke WAN. Every protocol and address here comes straight from the running-configs.

See how it worksShow less

eBGP hub in AS 65000 peering with each site edge in its own private AS (65001–65004) over /30 serial links
Chicago three-tier campus: core, two distribution 3650s, four access switches dual-homed, PVST+ blocking the loops
EtherChannel with LACP (Po1) and PAgP (Po2); native and management VLAN 99, off VLAN 1
OSPF area 0 in Mexico and Vancouver; router-on-a-stick for Mexico's VLANs; Vancouver hosts DNS and web

eBGPOSPFLACP / PAgP802.1QPVST+

Topology · from device configshover a site

router bgp 65000
 neighbor 10.2.10.1  remote-as 65002
 neighbor 10.2.10.5  remote-as 65004
 neighbor 10.2.10.9  remote-as 65003
 neighbor 10.2.10.13 remote-as 65001

ProjectRule 80BUILD

Smaller builds

Course · team of five

CineMate

Flask movie app with a CI/CD pipeline. Most commits on the team.

Nov 2025

Prescription ledger

Permissioned blockchain in Python tracking opioid prescriptions across doctor, pharmacist, patient and admin roles. I built the chain and backend.

Competition

TACOps

Ontario Tech cybersecurity event: 100+ Hack The Box style red-team challenges.

Stack

tools I've used on real systems

Network security

Firewall policy review (Check Point, Palo Alto, AlgoSec), segmentation, ACLs, NAT, VPN, DNS

Networking

BGP, OSPF, EIGRP, VRF, TCP/IP, routing & switching, Wireshark, packet analysis

Security operations

Splunk, SIEM, Nessus, Burp Suite, Nmap, Metasploit, OWASP Top 10, pentesting

Cloud & identity

AWS (EC2, S3, IAM, VPC, security groups), Google Cloud (Cloud Run, KMS, IAM), Azure (Entra ID, Intune), Active Directory, OAuth 2.0, RBAC

Build

Python, PowerShell, Bash, JavaScript, Node.js, Next.js, React, FastAPI, MongoDB, Docker, Terraform, Linux

EARNEDCertified AlgoSec Security User · ASMS Foundations Technical Training

EARNEDCisco CCNA: Introduction to Networks

COURSEIT and Cybersecurity Risk Management Essential Training

PENDINGCompTIA Security+ · expected Apr 2027

DEGREEBachelor of IT, Networking and IT Security (Honours) · Ontario Tech University · 2023–2027

rule 90 · permit you → me

Let's talk.

Emailmatthew.allicock@outlook.com

LinkedInin/matthew-allicock ↗

GitHubMatthewA15 ↗