Security engineer: detection, identity and security operations

More than ten years in corporate IT, security operations and security engineering. I've run Okta and endpoint security, led incident response, and reworked SIEM detections to cut alert volume by about 30%.

Right now I'm a contract security engineer, investigating identity, endpoint, phishing and fraud activity. On my own time I run a security lab and write up what worked and what didn't.

Resume (PDF) Projects LinkedIn Email

Experience

• Built one company's IT and security function as its first internal owner.
• Reworked SIEM detections, cutting alert volume by about 30%.
• Implemented DLP controls that cut exposed storage files by 50%.
• Incident commander and sole responder for a FedRAMP GovCloud environment.
• Use Claude Code to speed up investigations; people still make the consequential decisions.

Full work history in my resume (PDF) →

Featured work

• From identity attack to investigated alert

  One password-guessing test followed end to end: Okta, Elastic, a detection, AI triage with personal data kept out, and a verdict in Slack. Six steps ran live; the approval step is designed, not built.

• Keeping personal data out of an AI triage agent

  My first design hid only the values I'd listed, and it leaked twice. Stand-ins now replace every address, place and outside email before the model or Slack sees them.

• An MFA fatigue detection, and the test data I guessed wrong

  A push-bombing rule as code, tested in CI. One real push showed my test data used the wrong event for a denial.

• Missing logs that weren't missing

  A log line said events were being dropped. I wrote up a root cause, then measured it and found I was wrong.

All projects →

Tools

• At work: Okta, Entra ID, Google Workspace, Microsoft 365, SentinelOne, CrowdStrike Falcon, Red Canary, Jamf, Intune, Datadog SIEM, Elastic SIEM, Splunk, QRadar, XSOAR, Torq, Claude Code
• In my lab: Elastic, Sigma, Terraform, Python, Docker, Claude API and MCP