Securing systems. Thinking like an attacker.
Security Analyst with hands-on experience in threat detection, incident response, endpoint management, and security monitoring across a large enterprise network. Experienced in leading analysts through security investigations from detection to resolution. GCFA and Security+ certified.
Download full resume (PDF)// CERTIFICATIONS
// CORE SKILLS
// TOOLS & TECHNOLOGIES
Where I've worked.
April 2025 – Present
Cyber Security Analyst
United States Air Force
Colorado Springs, CO
- ▸Analyzed and triaged 250+ security events in real time, performing remediation or escalation across the Air Force Information Network
- ▸Executed incident response actions — account lockouts, device quarantine, malicious file remediation — to mitigate threats and secure systems
- ▸Reviewed and validated 100+ security events from new analysts, ensuring investigation accuracy
- ▸Tuned detection logic and supported detection engineering, reducing false positives across the enterprise
Insider Threat Detection & Investigation — Quarantine Bypass Incident
- ▸Detected unauthorized activity in which users executed custom scripts to remove 640+ workstations from mandated quarantine status, violating DoD/Air Force security standards
- ▸Built a custom detection query to identify all historical and ongoing instances of the activity across the enterprise
- ▸Led 6 analysts investigating root cause and incident scope, assessing risk to the Air Force Information Network from non-compliant, exposed devices
- ▸Briefed findings to the SOC Manager and senior leadership, driving decision-making on incident response priorities
- ▸Partnered with the Vulnerability Management Office to design and deploy an enterprise-wide remediation, reducing incidents from 640+ to 0
May 2024 – April 2025
Endpoint Security Specialist
United States Air Force
Colorado Springs, CO
- ▸Deployed and managed endpoint security agents (MDE, Trellix) across a 700,000+ device Air Force network, ensuring device compliance
- ▸Enforced DLP policies to restrict unauthorized removable media (USB) use, and processed DLP waivers balancing operational needs with security compliance
Selected work.
SOC Home Lab (Wazuh)
Built a self-hosted SOC lab in Wazuh, configuring endpoint monitoring, a custom detection rule, and an alert dashboard. Investigated a triggered alert and wrote a full incident report, mirroring a real SOC detection-to-resolution workflow.
Quarantine Bypass Detection
Built a custom detection query to identify 640+ workstations bypassing mandated quarantine via unauthorized scripts across the Air Force enterprise network. Led a 6-analyst investigation and drove remediation to zero incidents.
Red vs. Blue Team Exercise
Participated as Blue Team in Red vs. Blue exercises, performing detection engineering duties and maintaining the SIEM (Elastic/ELK) to identify and respond to simulated adversary activity.
Enterprise Endpoint Deployment
Deployed and managed endpoint security agents (MDE, Trellix) across a 700,000+ device Air Force network. Enforced DLP policies and processed waivers to maintain compliance at scale.
Let's connect.
Available for full-time roles, contract work, and consulting engagements. Drop me a message and I'll get back to you quickly.
[email protected]