About
I started my journey in helpdesk, moving into system administration before finding my focus in information security. Because I spent years managing the systems I now protect, I have a practical understanding of how they actually work, and where they tend to fail.
Today I work as a defensive analyst. Most days are alert triage, investigation and incident response on endpoint telemetry, with a growing share of detection engineering: turning what an investigation taught me into a rule that catches it next time.
Primary Focus
- Endpoint Detection & Response
- Triaging alerts and investigating endpoint telemetry to work out what actually happened.
- Detection Engineering
- Turning what an investigation taught me into a rule that catches it next time.
- Network Threat Hunting
- Finding C2 beacons and unusual patterns in Zeek telemetry with RITA.
- Learning in Public
- Working toward malware analysis and reverse engineering, and writing it up as I go.
I came to this from the network side, hunting through Zeek and RITA telemetry for beaconing and covert C2, and that shapes how I read endpoint data now. I stay focused on the "how" and "why" behind an alert rather than the verdict, and I am working deeper into malware analysis and reverse engineering.
Certifications
- Certified in Cybersecurity (CC) ISC2 Mar 2023
Training
- Advanced Network Threat Hunting Feb 2025Antisyphon Training with Chris BrentonC2 Detection Cyber Threat Hunting Network Threat Hunting
- Foundations of SOC with Elastic and Jira Feb 2025Antisyphon TrainingElastic Stack (ELK) KQL EQL Jira
- Getting Started in Packet Decoding Sep 2024Antisyphon Training with Chris BrentonTCP/IP IPv4 UDP TCP ICMP
- Blue Team Foundations with the Atomic Controls Mar 2024Antisyphon TrainingEnterprise Security Cyber Defense Windows Security Active Directory
- Active Defense & Cyber Deception Feb 2024Antisyphon Training with John StrandCyber Deception Honeypots Detection Sysmon
- SOC Core Skills Feb 2024Antisyphon Training with John StrandWindows CLI Linux CLI Wireshark Metasploit
- Enterprise Security for ALL Dec 2023Antisyphon TrainingVulnerability Assessment CIS Nmap Wazuh
- Defending The Enterprise Oct 2023Antisyphon TrainingActive Directory Windows Server PingCastle
- Cyber Threat Hunting Level-1 Oct 2022Active CountermeasuresCyber Threat Hunting Network Security AC-Hunter
If you want to talk shop about detection engineering, endpoint or network analysis, my email is on the contact page.
Get in Touch