About

I'm a security engineer with more than ten years in corporate IT, security operations and security engineering. Most of my work has been identity, endpoint security, detection and incident response. At one company I was the first internal owner of IT and security.

Resume (PDF) LinkedIn Email

Experience

• Security Engineer (contract) a fintech company · 2026–present

  • Investigate endpoint, identity, phishing and fraud activity across the SIEM, EDR, identity provider and workspace tools.
  • Tune SIEM detections and investigation workflows: refine filters, suppress known-benign patterns, and add context where coverage or triage is weak.
  • Use Claude Code for investigation enrichment, SIEM analysis and repeatable workflows, with consequential actions kept under human review.

• Senior Security Engineer (contract) Vera Therapeutics · 2025–2026

  • Owned security engineering across endpoints, infrastructure, cloud services and operational controls, from hardening and troubleshooting through remediation.
  • Led a vulnerability management platform from proof of value through selection and implementation, then set up a practical remediation process with system owners.
  • Led the evaluation and design of ZTNA and CASB, balancing access needs, network behavior, user impact and security risk.
  • Investigated activity through Red Canary and SentinelOne. Maintained standards, runbooks, risk assessments and controls for ISO 27001, NIST, HIPAA and SOC 2.

• Cyber Engineer / Analyst Armis · 2022–2025

  • Helped build and run the security operations program across endpoint, identity, cloud, SIEM, DLP, vulnerability management and incident response. Implemented and used Elastic SIEM.
  • Administered CrowdStrike Falcon: investigations, containment, prevention policy, and troubleshooting with IT.
  • Reworked SIEM detections and correlation logic, cutting alert volume by about 30% while keeping useful coverage and giving responders more context.
  • Implemented DLP controls that cut exposed storage files by 50%, working through findings, exceptions and remediation with data owners.
  • Incident commander and sole responder for the FedRAMP GovCloud environment: containment, recovery, after-action reports and control improvements.

• Corporate Security Engineer Demandbase · 2021–2022

  • Administered identity, endpoint and security systems: Okta, Entra ID and Conditional Access, Intune, Microsoft Defender, SentinelOne, Red Canary, Cloudflare, Jamf and AWS.
  • Restructured Okta around joiner-mover-leaver workflows, SSO and MFA, group-based access, role changes, onboarding and offboarding, and recurring access reviews.
  • Managed endpoint policy through Jamf and Intune, and investigated endpoint events through SentinelOne and Red Canary.
  • Administered Microsoft 365 security and compliance controls, including Defender and Purview.
  • Worked with IT, HR, Engineering, Legal and leadership on access reviews, third-party risk, audit evidence and SOC 2, ISO and CIS control work.

• SOC / Threat Analyst PG&E · 2020–2021

  • Investigated alerts in a regulated 24/7 SOC using QRadar, endpoint telemetry, network data and threat hunting; documented and coordinated response in XSOAR.
  • Triaged endpoint alerts and supported firewall, segmentation and containment work during active investigations.

• Security Operations & IT Manager Peerspace · 2018–2020

  • Built the company's IT and security function as its first internal owner: Okta identity, onboarding and offboarding, endpoints, SaaS, networks, email security and incident response.
  • Implemented Okta SSO and groups; managed Jamf, Carbon Black, Google Workspace, Meraki, 1Password and DMARC, DKIM and SPF.
  • Worked directly with leadership, HR, Engineering, Legal and Finance on access, vendors, risk, budgets and security priorities.

• Senior IT Engineer Indeed · 2016–2018

  • Administered macOS, Windows and Linux with Google Workspace, Jamf, OneLogin, Active Directory, Duo, VPN, NAC and firewalls; managed SSO, SaaS access and provisioning.

• IT Support Specialist Varsity Technologies · 2015–2016

  • Supported nonprofit client environments across Windows Server, macOS, Linux, VMware, Cisco and Meraki networking, and HIPAA-regulated systems.

Certifications and education

GCIH · CompTIA Security+ · CompTIA Network+ · CompTIA A+ · CompTIA Secure Infrastructure Specialist (CSIS)
Economics, CSU East Bay

How I work

I test access by trying things that should fail. If a monitoring account can delete backups, I want to find that out myself.

I keep security decisions in code. In my triage agent, the model summarizes and suggests, and code validates every tool call. The agent has no tools that change anything. Actions that would need my approval are designed but not built yet.

I check the logs before I call something done. In one test the Okta console showed a permission as granted. The audit log showed it wasn't, and the log was right.

When something looks broken, I measure it before I fix it, and I keep my notes when I turn out to be wrong. One of my write-ups is about that.

I keep secrets out of my repos and my logs. Every push to this site runs gitleaks and a check for internal hostnames and IDs.

In my lab

The tools I use in my homelab. My work tools are in the experience above.

Resume

Download my resume (PDF) or find me on LinkedIn.