Gonzalo Romero

Open to roles and projects Argentina · remote · UTC−3

Gonzalo
Romero

AI Engineer · Software Engineer · Penetration Tester

I build LLM systems that have to be correct, not just impressive, and the secure backends they run on.

See my work Request a service Download CV EN Also in ES · PT
programming
15+ years
offensive security
6 years
main stack
Python · TS · Go

How I got here

I started programming at 15 as 777vs666, writing Lua mods for S.T.A.L.K.E.R. and helping translate Call of Pripyat into Spanish for a small community. Trying to stop the X-Ray engine from crashing taught me C++. The engine kept crashing.

Read more

Then came C#, Ruby and Python, and with them data science and deep learning. In 2020 I started on public bug bounty programs on HackerOne and Bugcrowd. They grew into private penetration-testing engagements, which paid for everything else I wanted to learn, and I ended up building an agentic LLM layer on top of OWASP ZAP to automate discovery and triage.

Today I run Blue Rings Labs, my engineering, research and education lab, and Puppizz Games, an indie studio working on Life Chronicles.

I love this.

~/work

Blue Rings Labs

Blue Rings Labs is the culmination of 15 years of preparation and experience in systems engineering, software and AI. It offers everything from free resources, such as open-source projects and intensive courses in mathematics, ML/DL and AI, to personalized consulting, penetration testing and custom software development.

Almost all my work is released under glromero / BlueRingsLabs.

BlueRingsLabs/Clinical-Deep-Research_CDR Open alpha

Clinical Deep Research

An open evidence engine that reads the clinical literature and traces every claim back to its source passage.

  • Python 3.12
  • LangGraph
  • FastAPI
  • Hybrid retrieval
Details

A 13-node LangGraph pipeline with Pydantic contracts between nodes and support for 8 LLM providers. It extracts PICO from a clinical question, searches PubMed and ClinicalTrials.gov with hybrid ranking (BM25 + dense + rerank), screens studies PRISMA-style and rates risk of bias with RoB 2 and ROBINS-I. A skeptic agent attacks every claim, and a verification gate marks any report with an untraceable claim as unpublishable.

License
Apache-2.0
Repository(opens in a new tab)
BlueRingsLabs/Cortex_v2.0.0 Live demo

Cortex 2.0

A sovereign operations platform for telecom operators: BSS, OSS, CRM and ERP on one data model.

  • Python
  • PostgreSQL 16
  • React
  • TypeScript
Details

Designed and written as sole author. It covers rating, prepaid balances, invoicing and fiscal filing, number portability, eSIM, general ledger and payroll, with a 198-capability authorization engine, DPoP key-bound sessions and an Ed25519-signed, hash-chained audit trail on a separate database. The public repository holds the API specification, dependency-free webhook SDKs for Python, TypeScript and Go, and the benchmarks.

  • p95 under 100 ms on all 67 console reads, three tenants, one 4-vCPU machine
  • 0 double grants across 160 concurrent prepaid authorizations
  • 10,649 records/s ingest: 128,000 records through month-end in 63 s
License
Proprietary · public SDKs Apache-2.0

The demo accounts are listed in the repository README.

Try the live demo(opens in a new tab)Evaluation runbook(opens in a new tab)Repository(opens in a new tab)
BlueRingsLabs/no-shortcuts Free course

No Shortcuts

Data, ML, deep learning and AI engineering, the long way round.

  • 173 lessons
  • 166 labs
  • Tested in CI
Details

A free course for people who want to do the job, not just hold the title. Ten parts take you from linear algebra to training a small GPT and serving it in production, about 1,800 hours of work. Every lab runs in CI before it lands, and every system it teaches you to build, it also teaches you to attack.

License
CC BY-NC 4.0
Start the course(opens in a new tab)
BlueRingsLabs/awesome_cybersecurity Open source

Awesome Cybersecurity

A cybersecurity knowledge base you can read on GitHub or consume as data.

  • 490 resources
  • 18 categories
  • 100% coverage
Details

Organized by a taxonomy aligned to CyBOK v1.1 and the NICE Framework, and published as index.json and index.yaml for dashboards, search and agents. Contributors drop a Markdown note into the inbox; an LLM pipeline that rotates across Gemini, Gemma and Groq classifies it, checks its license and files it. Strict mypy and SHA-pinned CI.

License
MIT
Repository(opens in a new tab)

~/services

Work with me

The open-source projects and courses stay free. For paid work, these are the four kinds of engagement I take on.

AI Systems Engineering

LLM pipelines, RAG and multi-agent systems, built for production.

For Teams with a prototype that works in a notebook and now has to survive real users, real data and real attackers.

What's included
  • Architecture and build of RAG pipelines and agent workflows
  • Evaluation harnesses that measure quality before launch
  • Guardrails, PII handling and access control
  • Deployment, observability and cost tracking

Software & Systems Architecture

Custom backends and platforms, designed from first principles.

For Products that need a solid core: services that stay fast under load and data models that will not fight you later.

What's included
  • Backend services and APIs
  • Data platforms and system integrations
  • Architecture and performance reviews
  • Benchmarks you can reproduce

Security Assessments & Penetration Testing

Find out how your system breaks before someone else does.

For Web applications, APIs and AI features that need authorized, scoped testing, backed by six years of offensive security work.

What's included
  • Web application and API penetration tests
  • LLM and RAG security: prompt injection, data leakage, tool abuse
  • Secure code and architecture review
  • A report with reproducible findings and prioritized fixes

Mentorship & Technical Training

Senior guidance for engineers and teams moving into AI.

For Engineers and teams who want the math, the code and the production practice, built on the No Shortcuts curriculum.

What's included
  • One-to-one mentoring and career guidance
  • Workshops on ML, deep learning and AI engineering
  • Code and architecture reviews
  • Study plans built around your goals

How an engagement starts

  1. Send the formDescribe the problem, your timeline and any constraints.
  2. Scoping callWe agree on what success looks like.
  3. Written proposalScope, deliverables, timeline and price.
  4. DeliveryIn milestones you can review as we go.
Request a service(opens in a new tab) Questions? Email the lab

~/contact

Get in touch

Two inboxes, so nothing gets lost. Pick the one that matches why you are writing.

Blue Rings Labs

Consulting, development, security audits and training

New requests go through the form. It asks for scope, timeline and budget, so I can answer with something concrete.

Open the request form(opens in a new tab)

Questions about a request already sent:

blueringslab@gonzaloromeroai.com

SubjectService: [service] · [company]

Write to the lab
Elsewhere