Journey

Toolkit

Detection & Response

Alert triage Incident response Threat containment OSINT investigation Packet analysis

Tooling

Elastic / Kibana Microsoft Defender for Endpoint Active Directory Jump Software / CLI

Cloud & Infrastructure

AWS Azure Unix / Linux Python

Frameworks

NIST 800-53 MITRE ATT&CK OWASP Top 10 DISA STIG

Timeline

2024 - Present

Triage Security Engineer 1

Arctic Wolf Networks

I investigate endpoint, network, and identity alerts (malicious URLs, account takeovers, breaches) over the phone and by ticket. When something is live, I contain the device and get it to Tier 3 fast enough to limit what an attacker can do.

One I'm proud of: a teammate had triaged an anomalous sign-in from a low-prevalence hosting provider as a medium. Looking at the activity around it, I saw restricted country logins, MFA modifications, and anomalous token use. I raised it to high, submitted a callout, and contained the device. That's a bold call for a Tier 1, and when Tier 3 joined the ticket they first read it as a medium too. I held my ground, the activity kept coming, and we reached the customer. They wrote back confirming the user was compromised and thanking us for stopping it.

When I see the same gap causing repeat problems, I push for a real fix: an account-takeover alerting bug, a risky button on the triage dashboard, and a metric that discouraged teamwork (see Projects). I'm also the go-to person for over half of our Tier 1 analysts and interns, and I received Arctic Wolf's peer-nominated Golden Wolf award for leading our cultural events and lifting team morale.

2022 - 2024

Security Analyst

Bridgewater Bank

At a bank, speed and accuracy both matter. I led incident response and containment in Azure under strict SLAs: removing devices remotely, securely wiping data, running vulnerability scans, and working investigations across teams to close the exposure window before a threat could spread.

I analyzed suspicious emails, packet captures, and domains with OSINT tools to catch phishing and confirm malicious indicators. I also built the Conditional Access and Intune policies that balanced 90% external request availability with device compliance, so people stayed productive without weakening security. I administered accounts for 250+ employees with zero security breaches.

2019 - 2021

System Administrator

Canary Consulting

I kept 200+ users at finance clients running: ServiceNow tickets, routine patching, and maintenance done early enough to catch problems before they became outages. I held a 90% satisfaction rate and talked with 30+ clients a day, which helped me spot recurring issues and fix the root cause instead of the symptom.

I automated account setup with Active Directory templates, making onboarding 25% faster, and tightened access controls and firewall rules, cutting network security incidents by 15%. This is where IT started turning into security work for me.

2016 - 2022

Patient Service Representative

Patient First

At the urgent care, we ran everything on a keyboard-only, DOS-style system. It wasn't what drew me to IT, though - that was my affinity for computers and for figuring things out.