Clearance & Eligibility: U.S. Citizen. Eligible for a security clearance. DoD 8140 / 8570 IAT Level II baseline (Security+). Experience aligned to NIST SP 800-171, NIST SP 800-53, CMMC, and DFARS 252.204-7012.
Security and risk analyst working across governance, risk and compliance, vulnerability management, and security operations. Current work centers on third-party and software security assessment: scoping vendor reviews, producing severity-rated risk registers with remediation guidance, mapping findings to internal policy and recognized control frameworks, and carrying them through to closure with business owners. Prior security operations experience covers SIEM and endpoint monitoring on Splunk and Microsoft Sentinel, incident response and forensic investigation, and vulnerability remediation aligned to NIST SP 800-171 and DFARS 252.204-7012, and that operational grounding is what makes the risk work practical rather than theoretical. I also build the tooling: detection-as-code pipelines, purple-team validation against MITRE ATT&CK, secure CI/CD with supply-chain signing, and an AI-governance audit tool built for EU AI Act, SOC 2, and ISO 42001 evidence. Independently credited on a CVSS 9.9 CVE and active in coordinated vulnerability disclosure.
Professional Experience
Governance, Risk and Compliance Analyst, independent practice
2026 - Present
- Own software and vendor security assessments end to end, from intake and scoping through a severity-rated risk register with documented remediation guidance, reviewed with IT leadership before purchasing or deployment decisions are made.
- Conduct third-party due diligence on prospective vendors, including security questionnaires, external posture review, and written risk memos that give decision makers a clear recommendation rather than a list of raw findings.
- Administer the enterprise security awareness training program, running user audits, tracking campaign compliance, and following up directly with business owners to close gaps.
- Map assessment findings to internal policy and recognized control frameworks, and document control gaps with the evidence needed to support them under audit.
- Manage assessment intake, tracking, and closure through the IT service management system, maintaining an audit-ready record for each engagement.
Security Operations Center Analyst, security operations
2024 - 2026
- Monitor and triage 150 to 300 alerts per shift across Splunk, Microsoft Sentinel, SentinelOne, and Stellar Cyber at an MSSP, supporting compliance against documented client security policies and federal control baselines.
- Investigated ransomware intrusions, producing timeline analysis, IOC documentation, and evidence packaging that supported a successful cyber-insurance claim resolution.
- Perform vulnerability analysis on Windows and Linux endpoints, validate findings, map them to MITRE ATT&CK and NIST controls, and author remediation guidance for client tenants.
- Track and validate more than 100 vulnerability remediation actions, sustaining a 90 percent or better on-time patching rate with audit-ready evidence of control effectiveness.
- Reduced false-positive escalations by roughly 35 percent through detection-rule tuning and parameterized KQL notebook workflows in Microsoft Sentinel.
- Author incident reports, remediation playbooks, and policy-to-control mappings aligned with NIST SP 800-171, and maintain full SOP compliance across incident documentation.
Independent Security Researcher, independent practice
2026 - Present
- Conduct coordinated vulnerability disclosure on Bugcrowd and HackerOne across managed bug-bounty programs.
- Submitted research to programs spanning managed databases (PostgreSQL, MySQL, ClickHouse, Valkey, Kafka), MPC and blockchain platforms, and major web services.
- Work from source-code analysis, protocol-level review, and reproducible proof-of-concept development across cryptographic libraries, database engine internals, blockchain consensus, and OAuth / MCP authorization-bypass chains.
- Built an autonomous, multi-agent vulnerability-research platform that reproduced proof-backed findings across more than 20 open-source projects under a strict reproduce-before-report standard, spanning access-control, SSRF, path traversal, injection, and memory-safety classes.
Relationship Banker, retail banking
2023 - 2024
- Performed daily digital security and compliance checks, verified transactions, and authenticated customer identities with multi-factor procedures at full policy compliance.
Security Projects & Research
Oversight Protocol (lead maintainer). Open-source cryptographic data-provenance system. A 12-crate Rust workspace (about 10,300 lines) plus a Python reference implementation (about 13,400 lines) with bit-identical cross-language conformance. Hybrid classical and post-quantum cryptography: NIST FIPS 203 (ML-KEM-768) and FIPS 204 (ML-DSA-65), X25519, Ed25519, XChaCha20-Poly1305, Sigstore Rekor v2 transparency, and RFC 3161 timestamping. 141 tests. (oversightprotocol.dev)
GEMINI Malware-Analysis Lab. A sealed, air-gapped lab for static triage and live DFIR. Detonated real ransomware in isolation, captured a 4.1 GB live memory image, recovered AES key schedules from memory with a custom scanner, and reconstructed the encryption timeline in Volatility 3. Every claim is evidence-gated.
Flywheel. An autonomous, multi-agent security-research platform built for authorized testing. A staged decision graph maps a target, forms hypotheses, drafts a proof of concept, and only reports a finding once a deterministic validator reproduces it.
Detection-as-Code. Sigma detections mapped to MITRE ATT&CK, linted and tested in CI, and compiled to Splunk SPL, Microsoft Sentinel KQL, and Elastic from a single source.
Purple-Team Lab. Atomic Red Team and MITRE Caldera techniques run against an instrumented endpoint, with custom Wazuh rules and an ATT&CK coverage matrix confirming each technique fires at the correct severity.
SOC Automation & CTI. Wazuh into Shuffle SOAR into TheHive case management with automated enrichment, plus a CTI pipeline that ingests live threat-intel feeds, extracts ATT&CK techniques, generates Wazuh rules, and routes them through an analyst approval gate before deployment.
CI/CD Supply-Chain Security. Keyless Cosign image signing, signed SBOM attestation, grype scanning, and a Kyverno admission policy that enforces verified provenance.
Full write-ups with screenshots and code are in the index.
Personal Infrastructure Lab
- Operate a self-hosted Proxmox VE cluster with GPU passthrough, running more than 14 LXC containers and VMs across Debian, Ubuntu, and RHEL-family guests, hosting a VPN gateway, a DNS sinkhole, a backup server, a full Wazuh SIEM stack, and automated security workloads.
- Hands-on with hypervisor administration, LXC and KVM orchestration, GPU passthrough, VLAN segmentation, firewall policy, automated backups, headless Linux deployment, and systemd service management.
Core Technical Skills
SIEM & Detection Engineering: Splunk, Microsoft Sentinel, SentinelOne, Stellar Cyber, Wazuh, Elastic Stack, KQL, Sigma, detection-as-code, correlation-rule tuning, alert triage, MITRE ATT&CK mapping.
Purple Team & Adversary Emulation: Atomic Red Team, MITRE Caldera, detection validation, coverage analysis, file integrity monitoring, auditd.
Incident Response & Forensics: Ransomware investigation, forensic timeline analysis, memory forensics (Volatility 3), IOC documentation, evidence packaging, cyber-insurance claim support.
Vulnerability Management & Research: Qualys VMDR, Nessus, OpenVAS, source-code review, proof-of-concept development, coordinated disclosure (Bugcrowd, HackerOne), remediation tracking.
Secure SDLC / DevSecOps: CI security pipelines, Semgrep (SAST), gitleaks, pip-audit, Sigstore / Cosign keyless signing, SBOM (syft), grype, Kyverno admission policy.
Endpoint & Identity: CrowdStrike Falcon, Microsoft Defender for Endpoint, Microsoft 365 Defender, Tanium, Okta, Mimecast.
Windows & Linux: Windows 10/11 and Server, Active Directory, Group Policy, PowerShell, Sysmon; Debian, Ubuntu, RHEL-family, systemd, Bash, OS hardening.
Cloud & Networking: Microsoft Azure (administration, Sentinel, Defender for Cloud), identity and access management; TCP/IP, DNS, routing, firewalling, VLANs, Wireshark, WireGuard, pfSense, Palo Alto, Fortinet.
Compliance & Risk: NIST SP 800-171, NIST SP 800-53, CMMC, DFARS 252.204-7012, STIG hardening, control-gap assessment, policy and SOP authoring, audit-trail documentation.
Scripting & Languages: Python, PowerShell, Bash, KQL, Rust, FastAPI, REST API integration, Git.
Certifications
- CompTIA Security+ (SY0-701), DoD 8140 / 8570 IAT Level II baseline
- Microsoft Certified: Security Operations Analyst Associate (SC-200)
- Microsoft Certified: Azure Administrator Associate (AZ-104)
- Microsoft Certified: Azure Fundamentals (AZ-900)
- SentinelOne Incident Responder Certification
Education
High School Diploma, 2021. Self-directed study in security engineering, applied cryptography, and detection engineering.