I help enterprises reduce risk across security operations, cloud, and application layers — blending threat detection, incident response, and secure development to protect the systems people rely on. Four-plus years of building resilient defenses, hunting emerging threats, and partnering with engineering teams to ship secure software by default.
I'm a cybersecurity practitioner who genuinely loves the craft — the mix of investigation, engineering, and communication that makes real defense work. My career has centered on building resilient security operations, hardening cloud environments, and helping developers ship applications that stand up to modern threats.
I gravitate toward problems that need both technical depth and calm judgment — chasing an anomaly across SIEM pipelines, threat-modeling a new API before it ships, or partnering with engineering on a secure-by-default pattern. I treat security as a product: measurable, iterated, and shaped by the people who depend on it.
Whether I'm running an incident response, tuning detections in Sentinel or Splunk, or reviewing an AppSec pipeline, I aim for outcomes that stick: reduced dwell time, fewer repeat findings, and teams that trust security to help them move faster.
From SOC operations to secure delivery — a full-stack defensive skillset shaped in real enterprise environments.
24/7 detection, triage, and response across SIEM, EDR, and cloud telemetry pipelines.
Contain, eradicate, and recover from live threats with structured NIST-aligned playbooks.
Hypothesis-driven hunts using MITRE ATT&CK to surface stealthy adversary behavior.
Shift-left AppSec with SAST, DAST, SCA, and threat modeling embedded in CI/CD.
Harden AWS and Azure workloads with CSPM, IAM guardrails, and runtime monitoring.
Zero-trust IAM with conditional access, PIM, and least-privilege enforcement.
Custom detections, correlation rules, and dashboards for high-fidelity alerting.
Risk-based remediation across cloud, endpoints, apps, and infrastructure.
Security gates, developer enablement, and policy-as-code in the delivery pipeline.
SOAR playbooks and scripting to eliminate toil and cut mean-time-to-respond.
Selected initiatives that demonstrate detection engineering, cloud security automation, and secure delivery in practice.
Problem
Fragmented visibility across Splunk and Sentinel slowed SOC triage.
Unified detection console consolidating alerts, MITRE mappings, and asset context into a single analyst-first view.
Problem
Manual audits couldn't keep pace with a growing multi-cloud footprint.
Continuous CSPM engine that evaluates AWS and Azure workloads against CIS, NIST, and internal baselines with auto-remediation hooks.
Problem
API-first products needed repeatable AppSec coverage.
Chained SAST, DAST, and fuzzing pipeline that scores API endpoints for OWASP API Top 10 risks and generates developer-ready reports.
Problem
Siloed intel feeds diluted analyst focus.
Aggregation service normalizing IOCs across open-source and commercial feeds, enriched with context and pushed into SIEM watchlists.
Problem
Vulnerability data lacked business context for prioritization.
Risk-based vulnerability platform combining scanner output with asset criticality, exploit intelligence, and SLA workflows.
Problem
Ad-hoc IR notes and chat threads slowed post-incident learning.
Structured IR portal with case timelines, evidence vault, and lessons-learned templates aligned to NIST SP 800-61.
Structured investigation habits that turn ambiguous signals into confident, evidence-backed decisions.
Hands-on across healthcare, retail, and financial services SOC and AppSec programs.
Deep AWS and Azure fluency — from IAM guardrails to workload runtime protection.
Trusted partner to developers, IT, compliance, and leadership — security as an enabler, not a blocker.
Open to full-time, contract, and consulting engagements. Strong support for relocation across the United States.
The fastest way to reach me is email or LinkedIn.