Kirby Kuehl
Principal Engineer at Mimic
Chicago, Illinois, United States
Summary
👤
SeniorKirby Kuehl is a Principal Engineer in Chicago with over 16 years of hands-on experience designing and implementing endpoint and network security products across Linux, Windows, macOS, iOS, and Android. He specializes in low-level protocol encoding/decoding, stream reassembly, fuzzing, and client/server emulation, and has deep kernel- and appliance-level skills including Linux kernel modules and macOS KEXTs. Proficient in C, C++, Java, and Python, Kirby also builds big-data security pipelines using Hadoop ecosystem tools and Docker orchestration. His work includes byte-level parsers for protocols (ARP–HTTP, SMB/SMB2, DCERPC) and file formats (PE/ELF/Mach-O), and he has contributed substantive refactoring to the widely used Suricata IDS project. Known for pragmatic system optimization and tooling—Valgrind, gdb, sanitizers, and profiling—he pairs forensic-minded code auditing with production-grade engineering. Curious and thorough, he blends deep protocol expertise with cloud and appliance engineering to turn complex attack automation ideas into resilient products.
16 years of coding experience
22 years of employment as a software developer
Stackoverflow
1reputation
0reached
0answers
0questions
Github Skills (10)
c1710
cybersecurity10
drpc10
rpc10
c1110
smb10
dce10
intrusion-detection10
ids9
network-monitoring9
Programming languages (13)
Github contributions (5)
OISF/suricata
Jan 2010 - Jan 2021
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.
Role in this project:
Backend Developer
Backend DeveloperContributions:27 commits in 11 years 1 month
Contributions summary:Kirby primarily contributed to the Suricata network intrusion detection system by refactoring the DCERPC (Distributed Computing Environment / Remote Procedure Call) parser. Their commits focused on fixing padding calculations, and updating the stubdata parser for dcerpc. The refactoring work indicates a focus on preparing the system for handling DCERPC traffic over SMB (Server Message Block) and subsequently, implementing the SMB writeandx dcerpc integration.
git-repositorynsmipssecurityids
talus-framework/talus-client
Jan 2017 - Mar 2020
Talus command-line client
Contributions:2 PRs, 10 pushes, 2 branches in 3 years 3 months
command-line-toolcommand-linecli
Find and Hire Top DevelopersWe’ve analyzed the programming source code of over 60 million software developers on GitHub and scored them by 50,000 skills. Sign-up on Prog,AI to search for software developers.