The Engineer
Alberto Rosas
Cybersecurity & compliance-focused AI & Agentic Systems Engineer & Architect · 12+ yrs software / 5+ yrs production AI · Mexico · EN/ES native
I'm an AI and agentic systems engineer based in Mexico, with 12+ years in software and the last five on production AI. I build systems where the model is one component of something that has to be reliable, evaluable, and safe.
I didn't start in AI. I spent years in cybersecurity automation, running SIEM, IDS/IPS, and SOAR pipelines over millions of events a day. That background is why I design for agent safety, MCP attack surfaces, and policy-as-code from the start.
The other habit that carried over is measurement. Most “RAG works” claims fall apart under a real eval, so I build the evals first: custom harnesses, LLM-as-judge with measured agreement, CI-gated regression. Below the relevance bar, the system says it doesn't have sourced material rather than guessing.
Today I architect production agentic systems for customer-facing products, and I help mid-market teams find where AI actually pays off through TriageOps. Bilingual EN/ES, US-timezone friendly.
The evals run in CI, the threat model is a design-doc pass, and the guardrails are code. The discipline is automated and light, so problems surface in a build rather than in production.
What I build
Agentic Systems
Production agent systems end to end: orchestration, tool-calling, multi-step reasoning, intent routing, and memory that persists across sessions.
Retrieval
Hybrid retrieval that holds up on real corpora: dense, sparse, and graph combined with reranking, plus NL-to-SQL when the answer is a query rather than a paragraph.
Evaluation & Observability
Custom eval harnesses with LLM-as-judge and hallucination grading, gated in CI, with end-to-end tracing so regressions surface before users do.
Models
Frontier and open-weight models, including self-hosted deployment and fine-tuning for domain-specific tasks.
Production Engineering
Clean-architecture backends, async APIs, and containerized deployment, plus the platform migration and scaling work that keeps systems reliable under load.
Security and evals, built in
Carried over from years in security operations.
Threat Modeling
Threat modeling before a tool is granted
Attack surface mapped in the design doc before code, STRIDE-style, drawn from years of SIEM and SOAR operations. Tracked against the OWASP LLM and Agentic Top 10 and MITRE ATLAS.
Tool-Calling & MCP
Read-only enforced in the policy layer
On SADIE's MCP server, database access is read-only and enforced in policy code, not model behavior. Default-deny allowlist, with tool output treated as untrusted input.
Regulated Data
Governance for regulated data
500K+ regulated records under GDPR and HIPAA. Sensitive data routed to self-hosted models, PII masked before embedding, embeddings access-controlled like their source, tenant scope resolved at query time (OWASP LLM08).
Red-Teaming
Adversarial testing gated in CI
Systems red-teamed with garak and PyRIT, with findings gated in CI so a regression that reopens a known jailbreak fails the build. Tracked against the OWASP LLM Top 10 and MITRE ATLAS.
Runtime Guardrails
Layered runtime guardrails
Custom guardrails layered with Llama Guard and NeMo Guardrails, validating input and output on both sides of the model call. Code-executing tools run sandboxed in e2b behind an egress allowlist.
Governance
Governance and compliance readiness
Built the AI layer for a platform used by compliance auditors, with systems mapped to the EU AI Act, NIST AI RMF, ISO/IEC 42001, and SOC 2. Immutable audit trails over agent actions; refusal and confidence tiering surfaced to users when certainty is low.