Information for Prospective Students

I’m actively seeking undergraduate and graduate students to work with me on research. However, not every student is a good fit. The advice on this page will give you a sense what I’m looking for, so please read this before asking about a position.

Skills I Look For

The research I do involves a variety of technical and non-technical skills, and the needs of particular projects vary. If you’re a graduate student you should already be comfortable with a variety of these skills. Undergraduates should be adept with one or more and have a willingness to learn quickly about others.

  • Security: My research primarily involves the security of systems and networks; in particular, I want to make the world a safer place. This is a broad space and security is a property we seek in other systems, so it is very helpful to have an idea of what other areas of computing you are also interested in. Have you taken any security courses/participated in competitions/performed any projects?

  • Reverse Engineering: Embarking on new ideas often involves evaluating a new problem space. Do you enjoy dissecting systems and networks and learning how they work? Experience with reading RFCs and ISO/IEC standards and tools such as IDA/Ghidra/Wireshark will be useful.

  • Software and/or Hardware Development: Projects will involve the creation of custom tools in order to collect and analyze data, perform experiments, and make ideas tangible. Python and C are most relevant.

  • Technical Writing: Do you have experience with and enjoy reading and writing about technical topics? Great!

Interest in Research Required

Security is a fun and exciting field, but learning how to break systems is only a small part of our work. The students that I work most successfully with are interested in exploring what can go wrong and how to mitigate those problems. In order to do this well, you need to have a strong curiosity about how systems and networks really work.

Research is hard work. You must be willing to put in the time and effort to explore these problems deeply.

Take a Class With Me

The best way to get to know me and if we work well together is to take a class with me. It also gives me an opportunity to get to know you and your skills. If possible, please enroll in a course with me before contacting me about a lab position.

Current CU Students

If you think you are a good fit after reading this, please send me an e-mail to set up a meeting. In your first message to me, you should provide answers to the following:

  • Why me? There are many great faculty at CU. Look at my recent publications, project descriptions, and some of my talks on YouTube then tell me specifically why you are interested in working with me.

  • Why research? Tell me why you’re interested in getting involved in research in general, and specifically in the kind of research that I could help you with.

  • Your skills: Tell me about your experience with the skills above and show me some evidence. If you have found an interesting vulnerability or exploit, send me a link to one of your recent projects. If you have reverse engineered a protocol or some software, send me your artifacts. If you’re a great writer, send me a sample. If you have other talents, show me!

Prospective Graduate Students

  • Think you’d like to get a Masters degree or PhD? Apply to study in Computer Science or the Technology, Cybersecurity, and Policy Program. I am faculty in and can advise students from both programs. I strongly encourage you to get in touch with me in advance so that I can help you to determine which program is a better fit for you. On your application, make sure to list me as faculty you are interested in working with.


I want to thank Ben Shapiro for granting permission to liberally borrow from his prospective students page and Brian Dorn (vicariously) for aiding in the creation of this page.