USMC Veteran and lifelong learner holding a Master of Science in Cybersecurity and Information Assurance. Backed by 4+ years of total IT experience, including 1+ year engineering multi-tenant log correlation and high-volume incident triage within an MSSP SOC environment. Technical competencies include authoring custom SIEM detection logic, administering enterprise XDR/EDR platforms, developing automated orchestration workflows, and monitoring vulnerability lifecycles and identity access controls. Committed to continuous professional development, frequently validating new security methodologies using various platforms such as TryHackMe, Hack The Box, and Pluralsight alongside virtual homelab environments.

Start here for an overview of the full lab environment.

• Security Operations Homelab: Build Guide A high-level guide for building a security operations homelab similar to the environment behind these projects. Covers the build phases, the open source and commercial tools involved, and links to current documentation and enterprise trial options for each component.

• Security Information and Event Management with Wazuh Deployment of Wazuh as a central SIEM/XDR platform to aggregate endpoint telemetry, tune detection rules against false positives, and validate detection coverage against simulated brute-force and malware-drop scenarios mapped to MITRE ATT&CK.

• Enterprise Detection-as-Code & Log Correlation Suite Custom detection and hunting queries for Microsoft Sentinel and Rapid7 InsightIDR, mapped to MITRE ATT&CK and validated in an enterprise SOC environment. Includes a watchlist-based tuning pattern to reduce false positives from known-trusted sources.

• SOAR Playbook Engineering & Incident Response Automation An incident response workflow built on the open-source Shuffle platform: VirusTotal hash enrichment, ANY.RUN sandbox detonation for flagged indicators, and automated blocking of malicious callback IPs at the endpoint through the Wazuh active response API.

• Generative AI Incident Triage & Investigative Reporting A Python pipeline that parses Wazuh and Suricata log output and sends it to the Gemini API to draft a structured, MITRE-mapped incident report. Model output is treated as a first-pass draft for analyst review, not a final report.

• Enterprise Governance, Risk, and Compliance (GRC) & Vulnerability Management Framework A vulnerability management framework built on Greenbone (OpenVAS): risk-based prioritization using CVSS and CISA KEV data, a formal risk-exception process with logged compensating controls, and mapping to NIST SP 800-53 and SOC 2 Type II controls.

• Suricata Network Intrusion Detection System A network intrusion detection deployment using Suricata, with custom detection signatures, AF_PACKET tuning for multi-core packet processing, and traffic analysis mapped to MITRE ATT&CK.

• Vulnerability Assessment Engineering with Greenbone (OpenVAS) Credentialed vulnerability scanning of a legacy Windows 7 target using Greenbone (OpenVAS), with a documented override process for tracking accepted risk. The override record cross-references the corresponding risk-exception entry in the GRC framework.

• Linux Security Hardening & Compliance Audit A bash script that audits a Linux host against a subset of the CIS Ubuntu Benchmark, covering SSH configuration, host firewall status, file permissions, and audit logging. Each check maps to NIST SP 800-53 and SOC 2 Type II controls, using the same compliance framework as the GRC repository.

• Hybrid Identity Bridge: Entra Cloud Sync and Risk-Based Access Control Connects the on-premises domain controller to a Microsoft Entra ID tenant using Entra Cloud Sync, with Conditional Access policies covering admin role protection, legacy authentication blocking, and Identity Protection risk signals for sign-in risk and user risk.

• OSINT Aggregator CLI A Python command-line tool that queries multiple OSINT reputation sources for a single indicator from one place. It detects whether the input is an IP, domain, URL, email, or file hash, then routes the lookup to every applicable source. Modular source design means adding a new provider is a single file, and API keys load from the environment rather than the codebase.

• Master of Science (M.S.), Cybersecurity and Information Assurance — Western Governors University • View Diploma
• Bachelor of Science (B.S.), Cybersecurity and Information Assurance — Western Governors University • View Diploma