Security engineer with 3+ years in dedicated cybersecurity roles and 8+ years across enterprise IT and security. I investigate threats, build detections, and automate endpoint and identity controls.
Three representative cases show the security question, investigation or engineering method, and the control or decision left behind. Employer-sensitive details are intentionally sanitized.
01ENTERPRISE INCIDENT RESPONSE
The Boeing Company · 10,000+ endpoints
From alert to defensible incident decision
SplunkEndpoint telemetryNetwork forensics
Ownership
Lead investigator for assigned incident cases
Security question
Was the activity malicious, how far did it reach, and what action was justified by the available evidence?
Method
Correlated endpoint, identity, network, and vulnerability signals; investigated malware, compromised accounts, phishing, suspicious PowerShell, and network anomalies; documented findings; and briefed technical stakeholders on containment and resolution.
Result
Independently led 50+ documented incident cases and used investigation findings to improve Splunk correlation searches and behavioral detections.
02THREAT-LED DETECTION
OnMed · Notepad++ updater campaign
From public threat reporting to verified internal coverage
Microsoft SentinelKQLIOC analysis
Ownership
Owned the internal exposure assessment and preventive detection
Security question
Did a reported compromised updater path create real exposure inside the environment, or only a plausible external risk?
Method
Translated reported indicators and behavior into an exposure checklist, reviewed available endpoint and SIEM telemetry, assessed installed software, briefed technical stakeholders, coordinated preventive controls, and built a proactive Sentinel detection.
Result
Confirmed no vulnerable systems or evidence of compromise and left a repeatable detection in place for future coverage.
03IDENTITY AUTOMATION
OnMed · Microsoft cloud identity
Closing the gaps in offboarding access termination
Azure AutomationMicrosoft GraphPowerShell
Ownership
Owned the workflow redesign and automation implementation
Security question
How could offboarding reliably close active sessions, refresh tokens, group access, and cached credentials instead of relying on a fragile manual sequence?
Method
Rebuilt the workflow with Azure Automation and Microsoft Graph to disable accounts, revoke sessions and refresh tokens, remove group memberships, and address cached Windows credentials.
Result
Converted an incomplete manual process into a repeatable identity-control workflow with clearer ownership and more complete access termination.
SUPPORTING OUTCOMES
Additional results from identity, endpoint, and vulnerability engineering.
23
Entra ID Indicators of Exposure remediated
Closed identity risks involving legacy authentication, privileged access, MFA, and identity-risk controls after an 83% Purple Knight assessment.
40+
Critical findings closed within 90 days
Established vulnerability scanning and patch-management processes at Amilar Capital and drove documented critical findings through remediation.
150+
Windows and macOS endpoints administered
Operated Defender for Endpoint and Intune controls across web, network, application, removable media, and endpoint policy at OnMed.
02 TECHNICAL ARTIFACTS
SANITIZED FOR PUBLIC REVIEW
The thinking behind the outcome.
These artifacts expose the design choices, evidence flow, and failure handling behind representative security work. Names, thresholds, identifiers, and employer-specific logic have been removed or generalized.
ARTIFACT 01
DETECTION ENGINEERING
ILLUSTRATIVE DESIGN PATTERN
Behavioral correlation blueprint
Turn isolated telemetry into an evidence-backed review queue.
index=portfolio_lab sourcetype IN
("lab:endpoint", "lab:identity", "lab:network")
| eval entity=lower(coalesce(user, account))
| bin _time span=15m
| stats max(endpoint_signal) as endpoint
max(identity_signal) as identity
max(network_signal) as network
by entity, host, _time
| eval signal_count=endpoint+identity+network
| where endpoint=1 AND signal_count>=2
| eval severity=if(signal_count=3,"high","medium")
This original lab uses synthetic events and is separate from employer production logic. The complete query, data, expected result, and validation procedure are available below.
01SEP 2026 · PRESENTCDW / IGNW · The New SchoolSr. Security Engineer · Contract+
Security engineering and incident response for a large university environment, covering authentication monitoring, account takeover investigation, OAuth and malicious script review, and staged containment and reactivation for affected accounts in partnership with IAM.
Duo, Entra ID, Google Workspace Admin
MFA compromise and account takeover detection
OAuth revocation and staged containment
02OCT 2025 · JUL 2026OnMed, LLCSecurity Engineer+
Helped establish detection and response capabilities for a healthcare technology company while owning hands-on work across alerts, endpoint and identity security, detection tuning, vulnerability management, automation, and technical response.
Defender XDR, Intune, Entra ID, Elastic Security
150+ Windows and macOS endpoints
23 Entra ID Indicators of Exposure remediated
03MAR 2025 · AUG 2025Tilley DistributionCybersecurity Specialist+
Served as the primary internal security resource for a global environment of approximately 400 to 700 endpoints, covering alert triage, investigations, vulnerability remediation, and managed security coordination.
SentinelOne, Sumo Logic, Tenable
Alert triage and incident investigation
Vulnerability scanning and dashboards
04NOV 2022 · FEB 2025The Boeing CompanyCybersecurity Incident Response Analyst+
Investigated security incidents at enterprise scale, independently leading assigned cases involving malware, compromised accounts, phishing, suspicious PowerShell, network anomalies, and vulnerability events.
50+ documented incident cases
10,000+ endpoint environment
Splunk correlation searches and behavioral detections
05APR 2022 · OCT 2022Amilar CapitalSystems Administrator+
Hardened identity and network infrastructure supporting Bloomberg Terminal-integrated financial systems, implemented MFA and least privilege, and initiated an Azure migration.
Led end-to-end technology readiness for more than 10 retail launches across North America, coordinating networks, endpoints, audiovisual systems, vendors, testing, and post-launch support.
10+ retail launches
Network and endpoint deployment
Cross-functional delivery
07MAY 2018 · APR 2021ConcentricLifeIT Apprentice to IT Administrator+
Progressed into ownership of Cisco Meraki networks, identity, endpoint protection, segmentation, and infrastructure security for approximately 100 to 300 users.
Cisco Meraki networks
Okta, MFA, Jamf imaging
Endpoint and infrastructure investigations
2020 · 2025Columbia University Cybersecurity Boot Camp
Teaching Assistant, part time. Supported cybersecurity professional education alongside full-time technical roles.
04 TECHNICAL STACK
USED IN PRACTICE
Tools applied to investigations, controls, and security operations.