Open to security roles · Des Moines, IA & remote

Dakota Mason
Security, end to end.

Navy veteran, former federal police officer, and security researcher with two CVEs. I find what's broken, document it clearly, and help get it fixed. Currently focused on SOC analysis

Dakota Mason in a navy suit U.S. Navy veteran · 2015–2023
2 CVEsfrom authorized bug bounty research
8 yearsU.S. Navy & Navy Reserve
$6B+in installation assets secured
2× NAMNavy & Marine Corps Achievement Medals
June 2024 – Present · Des Moines, IA

Independent Security Researcher

Self-employedBugcrowdHackerOne2 CVEs assigned

After leaving the VA, I went all in on cybersecurity: full-time study for my B.S. alongside authorized bug bounty work on Bugcrowd and HackerOne. I test web applications inside each program's published scope, looking for the places where an application trusts the wrong person.

Two CVEs. I found two broken-access-control (IDOR) vulnerabilities that were assigned CVEs. My write-ups documented reproduction steps and impact clearly enough for the vendors to fix them, and both findings paid bounties.

What the work looks like

  • Reconnaissance, manual web application testing, and authorization-boundary testing within each program's scope.
  • Investigating cross-site scripting (XSS) and server-side request forgery (SSRF) findings, with reports that describe impact and repeatable steps.
  • Building Burp Cockpit, a Burp Suite extension that adds AI-assisted analysis to web security testing.
  • Running a Linux home lab: building and troubleshooting systems, and evaluating local AI models.
  • Building TAK, a Rust and C++ model-quantization tool whose published models beat a leading quantizer at the same file size (see Projects).

Tools

Burp SuiteNmapNessusGreenboneAWSLinuxPythonGitRustC++
Dakota Mason
Former Navy Secret clearance · CompTIA Security+ and A+
September 2022 – June 2024 · Des Moines, IA

Senior Police Officer, GS-0083-07

Department of Veterans AffairsVeterans Health AdministrationFederal law enforcement

As a federal police officer at the Des Moines VA medical center, I protected veterans, staff, and the sensitive information a hospital runs on. The job was part patrol, part investigator, and part access-control gatekeeper, and every part of it ran on careful documentation.

Investigations

  • Led investigations from complaint review through fact-finding, interviews, evidence handling, and reports for legal or administrative review.
  • Handled cases involving government laptops and more than $50,000 in government property.
  • Investigated online abuse, harassment, and misuse of government property; interviewed subjects, victims, and witnesses and weighed conflicting accounts to reach supported findings.

Protection and response

  • Enforced access controls and identity verification in restricted areas of the medical center.
  • Safeguarded PII and PHI under VA privacy requirements.
  • Responded to high-risk incidents, made arrests, and coordinated with federal, state, and local agencies.

Why it matters for security

Incident response, chain of custody, insider-threat awareness, and writing findings that hold up to review: the same habits a SOC depends on.

Dakota Mason in VA police uniform
On duty at the VA, 2024
December 2019 – April 2021 · Isa Air Base, Bahrain

Physical Security & Intelligence Specialist

U.S. NavyMA2 (E-5)DeploymentNavy & Marine Corps Achievement Medal

In Bahrain I owned physical-security responsibility for an installation holding more than $6 billion in assets. The work was risk management in the real world: find the gaps before someone else does, prioritize them, and brief leadership on what to fix first.

Assessment and risk

  • Conducted vulnerability assessments, security audits, and risk analysis for installation assets valued at more than $6 billion.
  • Prepared intelligence and security briefings for senior installation leadership, turning incoming threat information into concise, actionable priorities.
  • Handled classified information.

Leading projects and people

  • Managed security infrastructure, lock, and key-control projects from planning through completion.
  • Trained more than 150 personnel.
  • Received a Navy and Marine Corps Achievement Medal.
Dakota Mason in uniform in Bahrain
Isa Air Base, Bahrain, November 2020
Dakota Mason in uniform in the Djibouti desert with camels
Djibouti, May 2019
August 2018 – October 2019 · Camp Lemonnier, Djibouti

Patrol Supervisor & Master-at-Arms

U.S. NavyMA3 (E-4)Combat deploymentNavy & Marine Corps Achievement Medal

Camp Lemonnier is a forward-deployed joint installation in the Horn of Africa. I supervised the patrol and access-control operations that kept it secure, and led sailors in an environment where the threat was real.

  • Supervised personnel in patrol and access-control operations at a forward-deployed joint installation.
  • Served as incident commander during an emergency response.
  • Received a Navy and Marine Corps Achievement Medal.
Things I've built

Projects

AI model research, production web apps, and security tooling I designed, built, and shipped.

Flagship · Rust · C++ · CUDA

TAK: task-aware model quantization

TAK shrinks large language models to a fixed file size while protecting the skill you care about. Instead of compressing every tensor the same way, it measures how each precision change affects a target task, solves for the best allocation under an exact byte budget, and exports a standard GGUF that runs anywhere llama.cpp does. No fine-tuning, no model merging: only smarter precision.

Qwen3.8-27B · reasoning 82.81 vs 77.34 TAK beat Unsloth's UD-IQ2_S by +5.47 points at the identical 8.37 GB file size, landing within 0.78 points of the 54.7 GB original: 85% smaller for nearly the same reasoning.
Gemma 4 E4B · reasoning +14.06 points over Unsloth UD-IQ2_M, with a 9% smaller file
Qwen3.5-4B · reasoning +11.72 points over Unsloth UD-IQ2_M at the same size
  • Every score comes from the same frozen 960-item evaluation pack, run to completion with zero failed items. The headline is the run's target category; the other suites are diagnostics.
  • Rust application with a C++ worker on a pinned llama.cpp runtime. Runs on Vulkan or CUDA, with resumable, checkpointed jobs and a headless GPU deployment for models too large for a workstation.
  • Measures real tensor-format changes against the task's own grader, including executed-test grading for coding, and records signed effects of each change, alone and in pairs.
  • Published winners on Hugging Face as the TAK Reasoning Champions collection.
Iron Margins home page SaaS · PWA · Supabase

Iron Margins

Estimating, bidding, and invoicing software for contractors. It standardizes material costs, calculates true labor burden, including payroll taxes and workers' comp, and generates client-ready PDF proposals in minutes. Built as an offline-capable progressive web app.

Designed with a written threat model covering client-side trust, authorization bypass, and service-worker hijacking, with server-side validation and a strict Content Security Policy as mitigations.

Pearl Tide game art Mobile game · Three.js · Capacitor

Pearl Tide

A cozy 3D mermaid game for iPhone and Android. Players swim a reef, a kelp forest, and crystal caverns, help the sea creatures they meet, and decorate a home in a sunken ship across a four-chapter story.

Built in Three.js and wrapped for iOS and Android with Capacitor, with touch and desktop controls and adjustable graphics levels for phones.

More projects

Security tooling

Burp Cockpit

A Burp Suite extension that adds AI-assisted analysis to web security testing.

Private repo
Python

Glass Skull

A local Streamlit cockpit for running GGUF models through llama.cpp and visualizing model activity.

Python

smol-llm

A tiny GPT-style language model built from scratch for testing tokenizers, data quality, and training behavior.

JavaScript

LlamaCalc

A static command workbench that builds llama-cli and llama-server commands in the browser.

Game · PWA

Hostile Volume

A browser game with client-side state management and audio rendering.

Education & certifications

B.S., Cybersecurity Technology

University of Maryland Global Campus120 creditsGPA 3.25

All degree requirements completed in October 2026; conferral December 30, 2026.

Certification

CompTIA Security+

Earned April 2025

Certification

CompTIA A+

Earned April 2025

Relevant coursework

Ethical HackingPenetration Testing & Cyber Red TeamThreat Management & Vulnerability Assessment Cloud TechnologiesRed Hat Linux System AdministrationSwitching, Routing & Wireless

Skills

Vulnerability assessmentWeb app testingAccess control testingIncident response InvestigationsRisk analysisPII/PHI safeguardingTCP/IP LinuxWindowsSIEM monitoringSQL fundamentals
Cover of Redemption of the Fallen God
Published author

Redemption of the Fallen God

A God's Fall, A Mortal's Fate

I wrote and self-published a fantasy novel, available in paperback and Kindle. Taking a book from draft through editing, cover, and publication on Amazon KDP took the same persistence as any long project: ship it, measure it, and keep improving it.

View on Amazon →