Intro01 / 07

Montreal, QC, Canada

Farbod Farhour

Senior Software Engineer · Application Security · AI-native

At Security Compass, I lead AI engineering for SD Elements, a platform that maps security requirements to standards such as PCI DSS and SOC 2.

Now02 / 07

I build the parts that decide which requirements apply.

At Security Compass since June 2022, and Senior Software Engineer since February 2025. I’ve worked on the core security engine of SD Elements, its AI features, its AI service and its integrations, across 3 teams. SD Elements maps 8,000+ security requirements to 100+ compliance frameworks, including PCI DSS, SOC 2, NIST 800-53 and ISO 27001.

  • Rules engine

    Rebuilt core parts of the rules engine that decides which security requirements apply to each application, and made the All Tasks report explain why each one applies: a traceable reason for every requirement.

  • Scanners and integrations

    Turned scanner results into evidence: scanner imports now record a verdict for each security requirement, and the syncs to 8 issue trackers report each failed item and why. Also built an event-delivery engine.

  • AI service

    Hardened the AI service against prompt injection. Kept card numbers and SSNs out of the LLM: wrote the filter that redacts them from uploaded documents. Built text extraction for 10 file types, from PDF and Word to SPDX and CycloneDX SBOMs.

  • Agentic AI and mentoring

    Led the first SD Elements feature built with AI agents, and since 2025 made the case for agentic development: more than 10 talks to management, developers, QA and product, and an AI development lifecycle brief to the CTO. Mentored junior and mid-level developers for 4 years.

Built03 / 07

What I built at Security Compass.

  • SDK · 2026

    The company’s first SDK

    Solo and AI-driven: typed Python clients for 338 API endpoints.

    96% test coverage

  • Agent harness · 2026

    AI agent harness

    Runs the full SD Elements stack, from its 5 pinned product repos, on a Mac for engineers and AI agents: Docker services, guardrails for the agents and an MCP connection to the running app.

    95% test-coverage gate

  • MCP · 2026

    MCP tools

    Led and built the integration tools of the SD Elements MCP server, so AI coding agents can sync security tasks to issue trackers and run scanner verification from the editor.

    Merged August 2026

  • RAG · 2025

    Navigator search

    The retrieval layer of Navigator, the SD Elements AI assistant: vector search over the security content library, its search API and reindex command, and most of its TypeScript retrieval package.

    February – August 2025

Own projects04 / 07

I start what’s missing.

Three projects I started on my own.

  • Project · 2026

    SC Sentinel

    A multi-tenant SaaS that turns a team’s security policy into live context that AI coding agents check over MCP. I built its core: the MCP server, license gating and rate limits, key revocation, custom rules, and usage analytics with export.

    Visit sc-demo.xyz

  • Platform · 2026

    Agentic software factory

    My own self-hosted platform, where AI coding agents ship software through policy gates and I approve every merge. Its AI Harness has 7 releases, 537 tests and 191 deny rules, and I run its infrastructure like a compliance program.

    Merge requests shipped
    about 1,800
    Pipeline runs
    about 9,500

    Across 16 GitLab projects since March 2026

  • Hackathon · 2025

    RefactorGuard AI

    Turns a codebase into a dependency graph, so an LLM’s refactoring answers are checked against the real code structure. A solo entry in Google DeepMind’s Gemini 3 hackathon on Kaggle, in December 2025.

    Read the writeup on Kaggle

Research05 / 07

My M.Sc. research, published.

My thesis at Concordia University, defended in May 2022, became this paper at FSE 2024. I’m the first author.

Paper · FSE 2024 A Weak Supervision-Based Approach to Improve Chatbots for Code Repositories Farbod Farhour, Ahmad Abdellatif, Essam Mansour, Emad Shihab Proceedings of the ACM on Software Engineering, vol. 1 (FSE), pp. 2378–2401 doi.org/10.1145/3660812
The path06 / 07

13 years from mobile apps to ML research to application security.

  1. 2009 – 2013B.Sc. in Computer ScienceShahid Beheshti University.
  2. 2011 – 2014Web & Software DeveloperKhobregan Saham Brokerage. Web and mobile apps, and the Linux servers they ran on.
  3. 2013iOS DeveloperPichak. Part of the team behind Recordium, a top-10 app in more than 50 countries.
  4. 2013 – 2015M.Sc. in Computer ScienceAmirkabir University of Technology. Thesis on controllability in biological networks.
  5. 2016 – 2019Full Stack DeveloperHoush Gostar. Helped build trading software, the largest online auction and tender platform in its market, and a platform that deploys and manages servers securely across AWS, Google Cloud, DigitalOcean and Vultr.
  6. 2019 – 2022M.Sc. in Computer ScienceConcordia University. Research Assistant from 2019 to 2021 and Teaching Assistant from 2021 to 2022. Thesis defended in May 2022, published at FSE 2024.
  7. 2022 – 2025Software EngineerSecurity Compass. The core security engine of SD Elements, its AI features and its integrations, such as Jira.
  8. 2025 – nowSenior Software EngineerSecurity Compass. Navigator search, the SDK, the AI agent harness and the MCP tools. I lead AI engineering now.
Contact07 / 07

Let’s talk.

Farbod Farhour · Montreal, QC, Canada