Nathan Brahms
San Francisco, California, United States
Summary
🤩
RockstarNathan Brahms is a seasoned software leader and co-founder currently serving as Vice President of Engineering at P0 Security, bringing 11 years of engineering and management experience to developer-focused application security. He helped scale Semgrep as a core contributor—improving pattern matching, f-string and identifier handling, and security rule quality—bridging deep backend engineering with practical vulnerability detection. Nathan has led teams across startups and enterprise settings (r2c, Cisco Meraki, Arrayent), shipping revenue-driving products and low-latency geolocation and ETL systems while fostering inclusive, high-performance engineering cultures. His background includes postdoctoral research at MIT and UC Berkeley and a PhD from Harvard, giving him uncommon depth in quantitative problem solving and experimental rigor for a security-focused technologist. Colleagues describe him as a hands-on leader who pairs mentoring and organizational coaching with the ability to dive into parser and matching logic when needed.
11 years of coding experience
Github Skills (18)
static-analysis10
python10
semgrep10
django10
security-scanner10
security10
regular-expression10
security-testing10
code-analysis10
security-scan10
program-analysis10
it-security9
javascript8
flask-ask7
go7
Programming languages (14)
Github contributions (5)
semgrep/semgrep
Apr 2020 - Jul 2022
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
Role in this project:
Backend Developer & Security Engineer
Backend Developer & Security EngineerContributions:1 release, 141 reviews, 167 commits in 2 years 3 months
Contributions summary:Nathan primarily focused on improving the Semgrep core functionality, specifically in the areas of pattern matching, code analysis, and security. They implemented metavariable matching between patterns, enhancing the tool's ability to find bug variants. Their contributions included adding support for matching of qualified identifiers, improving the handling of f-strings, and addressing vulnerabilities related to regular expression matching. Furthermore, they worked on improving the core code, addressing issues related to parsing, syntax, and matching logic.
looklinterpythonr2cjavascript
semgrep/semgrep-rules
Feb 2020 - Mar 2021
Semgrep rules registry
Role in this project:Security Engineer
Security EngineerContributions:12 reviews, 24 commits, 42 PRs in 1 year
Contributions summary:Nathan primarily contributes to security rule development for the Semgrep static analysis tool. Their work involves creating new rules, fixing false positives, and improving existing rules to detect vulnerabilities in various technologies, including Python (Django and Flask) and Java. The contributions range from identifying SSRF injection vulnerabilities to enhancing the detection of insecure cookie settings and other security-related code issues. The user also focuses on improving the performance of the rules.
securitysemgrepsemgrep-rulessemgrep-registryprogram-analysis
Find and Hire Top DevelopersWe’ve analyzed the programming source code of over 60 million software developers on GitHub and scored them by 50,000 skills. Sign-up on Prog,AI to search for software developers.