About
I work in security operations, incident response, and detection engineering, with hands-on experience triaging enterprise alerts, tuning SIEM/EDR/SOAR workflows, and preserving forensic artifacts during active investigations. I'm pursuing an M.S. in Cybersecurity at Georgia Tech (GPA 3.67, in progress), backed by a strong foundation in networking, systems administration, and practical security engineering.
Location
San Francisco Bay Area
Current Focus
Security Operations, Incident Response & Detection Engineering
Graduate Program
Georgia Tech, M.S. Cybersecurity (in progress)
Resumes
Cybersecurity Resume
Current focus: security operations, incident response, and security engineering
Older resumes
Certifications
- CompTIA A+, CompTIA
- CompTIA Network+, CompTIA
- CompTIA Security+, CompTIA
- CompTIA CySA+, CompTIA
- CompTIA SecAI+, CompTIA
Achievements
- Developed Microsoft Defender threat-hunting queries: built detections from critical, time-sensitive threat intelligence, distributed them across the department, and trained security staff to identify adversary activity during active incidents.
- Tuned Elastic EDR at enterprise scale: created over 100 Elastic EDR endpoint exceptions for a mixed fleet of over 45,000 endpoints, balancing detection efficacy with operational requirements while minimizing unnecessary exclusions.
- Performed rapid insider-threat triage and containment: contained a user account and workstation after discovery of a suspected foreign nation-state insider threat, preserving and collecting critical forensic artifacts under significant time constraints.
- Led investigation of unusual network-device activity: coordinated with stakeholders on poorly managed remote network devices, drove cross-team remediation, and improved documentation and device-management practices.
- Owned end-to-end compromised-workstation response: preserved forensic artifacts, reconstructed the attack timeline, contained malware spread, and maintained stakeholder communication through remediation.
- Led business email compromise response: contained affected users and devices, investigated mailbox activity, and hardened accounts; rewrote the incident response procedure to clarify escalation, evidence handling, and client communications.
- Strengthened Microsoft 365 identity security: implemented MFA and Conditional Access across client tenants, applied baseline Group Policy hardening, and used Microsoft Purview Audit for investigations.
- Secured client networks: deployed VLAN segmentation, firewall policies, VPNs, and IDS/IPS to improve isolation and reduce lateral movement risk, including in healthcare environments.