For Prospective Students

I’m glad you’re considering working with me at NC State.

Before You Email: At NC State, as in other large CS PhD programs, students typically connect with an advisor after joining the department. You do not need to email me or secure an advisor before applying, and emailing me does not affect your chances of admission.

• Already in the program? See PhD Students at NC State for research projects and advising.
• Applying to NC State? See Prospective PhD Students for application details.
• Interested in my research? See Working with Me for research interests and qualifications.

PhD Students at NC State #

If you are already at NC State and interested in working with me, send me a brief email. We can get to know each other before agreeing on an advising relationship through:

• Research: A research internship¹ or a semester-long independent research study.
• Classes: Taking one of my courses with a research component.

Faculty in NC State’s Wolfpack Security and Privacy Research (WSPR) Lab frequently co-advise students with overlapping or adjacent research interests. Check out the other affiliated faculty for potential co-advisors.

Prospective PhD Students #

You can apply to NC State’s Computer Science PhD program without having an advisor lined up, and emailing me does not improve your chances of admission. The usual steps are below.

1. Apply to NC State

Apply to the CSC PhD program². The application deadline is usually December 15 (official page), for fall admission only.

2. Indicate Your Research Interests

The following help me identify applications from students interested in working with me, in decreasing order of visibility:

1. List me as a primary or secondary faculty of interest.
2. Mention my name in your statement of purpose.
3. Select (Cyber) Security as a research area of interest.

3. Admission Decision

I do not schedule meetings before you apply. After reviewing applications, I contact candidates directly to arrange interviews.

The Graduate School and department handle admission, with input from faculty. Individual professors (including me) usually:

• Cannot guarantee admission or funding to anyone
• Cannot evaluate applications before the official review process
• Cannot provide individual feedback on rejected applications

4. Join and Connect with an Advisor

After accepting an admission offer and joining NC State’s CSC PhD program, you can contact professors to discuss research and advising. See PhD Students at NC State to connect with me.

Restrictions for International Students: If you are an international student, be aware that (cyber) security research involves topics that might fall under US control regulations or other legal constraints. These might include but are not limited to:

• Countries with International Trade and Arms Regulations (ITAR) Restrictions (e.g., Cuba, Iran, North Korea, Russia)
• Countries under certain US Sanctions (e.g., Cuba, Iran, North Korea, Syria)

For prospective students from such countries, it will be very difficult to impossible to obtain a visa, conduct research, or be employed in the cyber security area in the US.

Working with Me #

Qualifications: I am looking for students who have:

• A solid background in computer science, computer security, human-computer interaction, or related areas
• Prior exposure to computer security through classes, projects, or internships, so you know what draws you to this field and its particular challenges before committing to a five- to six-year PhD.

In addition, I value:

• Research experience (e.g., undergraduate research, Master’s thesis, publications in relevant venues)
• Experience with user studies and human subjects research
• Practical experience in software development or open source communities, since much of my research focuses on developers.

Research Interests #

My research focuses on the people who build and maintain the software we depend on. I take a human-centered approach to software supply chain security and open source security. More recently, I have been exploring how AI and autonomous agents change the work of developing and securing software. See the publications page for papers and details.

I often combine studies of people’s experiences with large-scale analyses of software and development practices, drawing on both qualitative and quantitative methods.