years in cyber defense
SECURITY ENGINEERING + APPLIED AI
I turn security noise
into defensible signal.
Six-plus years across Tier 3 SOC operations, enterprise incident response, detection engineering, penetration testing, and applied AI research.
00 / CAREER PROVENANCE
The artwork becomes
inspectable evidence.
Select a career record to trace the dates, responsibilities, and verified outcomes behind the signal archive.
OPERATING PICTURE / 00Career evidence console
Verified record
2023 to 2026
Trellix / Cybersecurity Engineer
Incident response and detection engineering across a North American client's 12 business units.
- 15+
- Production detections
- 15+
- Log sources onboarded
- 12
- Business units supported
- ATT&CK
- Detection mapping
business units supported
production detections
log sources onboarded
01 / EXPERIENCEThe signal has a history.Tier 3 SOC response / penetration testing / malware-execution research / enterprise detection engineering
EXPERIENCE / 0101 / LIVE INTEL
Operational depth,
measurable outcomes.
From Tier 3 SOC operations to enterprise detection engineering, the through-line is practical: clearer telemetry, faster decisions, stronger response.
01
Cybersecurity Engineer
NX · HX · HELIXTrellix Helix, HX, and NX incident response and detection engineering across a North American client's 12 business units.
- Led technical investigations, determined scope, and guided customer teams through remediation.
- Implemented and tuned 15+ production detections mapped to MITRE ATT&CK.
- Onboarded and validated 15+ application, endpoint, cloud, and infrastructure log sources.
02
Pentesting Intern
OFFENSIVE SECURITYContributed to eight team-delivered penetration tests and researched Windows malware execution techniques.
- Worked under manager guidance alongside other penetration testers.
- Studied malware execution behavior and endpoint telemetry.
- Identified opportunities for endpoint detection coverage.
03
Tier 3 SOC Specialist
SIEM · SOAR · IRMulti-client SOC leadership spanning enterprise incident response, SIEM engineering, detection strategy, and SOAR automation.
- Coordinated Tier 3 response during priority incidents in a 24/7 managed SOC.
- Built Siemplify SOAR playbooks for enrichment, phishing response, and containment.
- Authored SPL investigations and briefed client CISOs during significant incidents.
02 / SYSTEMSExperience compiled into working systems.Automation / regulatory traceability / EDR visibility / cloud defense
SYSTEMS / 0202 / CORE SYSTEMS
Selected systems,
defensible evidence.
Each system connects an operational problem to a concrete security decision, a measurable signal, and a path to inspect the work.
01
Agentic AI security
FEATURED ON KANZ AIRecorded system walkthrough / select play to inspect
Autonomous SOC Triage Agent
A bounded, auditable AI agent that triages EDR and SIEM alerts, selects threat-intelligence tools, resists prompt injection in attacker-controlled content, and submits every decision to a deterministic policy engine.
- Result
- 100% recall on the labeled evaluation set
- Signal
- 7 stages / 6-call budget / 4 policy constraints
- Agentic AI
- SOC
- EDR
- Policy engine
02
Applied automation
PRODUCTIONEndpoint health intelligence
Python automation that streamlined endpoint validation, automated repetitive checklist steps, and reduced manual analyst effort.
- Result
- Automated repetitive endpoint validation
- Signal
- Python / endpoint telemetry / analyst workflow
- Python
- Endpoint
- Automation
03
AI + regulatory engineering
RESEARCH PROTOTYPECompliance mapping agent
An agentic retrieval project exploring traceability across major security and privacy frameworks, designed to connect evidence, obligations, and controls.
- Result
- Connects evidence to control obligations
- Signal
- NIST / retrieval / agentic traceability
- AI agents
- NIST
- Traceability
04
Detection research
CONTROLLED LABEDR gap analysis
Controlled adversary simulation using Nim proof-of-concepts to study behavioral blind spots, including direct syscalls and in-memory execution.
- Result
- Turns blind spots into observable test cases
- Signal
- Nim / direct syscalls / EDR telemetry
- EDR
- Nim
- Adversary simulation
05
Cloud architecture
ARCHITECTURE CASE STUDYAWS security migration
A defense-in-depth cloud migration plan centered on hardened identity, segmented networks, defensible logging, and a measurable security baseline.
- Result
- Defines an identity-first, logged cloud baseline
- Signal
- AWS / IAM / segmentation / observability
- AWS
- IAM
- Cloud security
03 / RESEARCHObserved gaps become testable questions.Explainable AI / ATT&CK maturity / measurable SOC outcomes
RESEARCH / 0303 / SIGNAL / NOISE
Security research should change the way a SOC operates.
My doctoral work examines applied AI in cybersecurity: how intelligent systems can improve alert quality, preserve traceability, and reduce analyst fatigue without hiding the reasoning behind a decision.
Executive PhD, Information Technology
Artificial Intelligence emphasis · University of the Cumberlands
Master of Engineering, Cybersecurity
GPA 3.94 · University of Maryland
04 / CAPABILITIES
Capabilities
SIEM & SOAR
- Helix
- Splunk
- QRadar
- Siemplify
Endpoint & Network
- Trellix HX / NX
- Volatility
- Wireshark
Cloud
- AWS
- Azure
Query & Automation
- Python
- KQL
- SQL
Frameworks & Assessment
- MITRE ATT&CK
- Tenable
04 / CONTACTThe next signal starts with a conversation.Security engineering / incident response / cloud security / applied AI
CONTACT / 0505 / CONTACT
Need a clearer
defense signal?
For security engineering, detection, incident response, cloud security, and applied AI conversations.
Start an email