• Performed host and network-based forensics across Windows, MacOS, Linux platforms and cloud environments (AWS, Azure, GCP).• Developed novel methods to hunt for indicators of compromise (threat intelligence).• Coded infrastructure and tools automation (Terraform, Ansible, AWS) to conduct analysis across large sets of data (DFIR at scale - Velociraptor).• Managed incident response investigations - opportunistic and targeted threats such as BECs, FTFs, ransomware and APTs.

Teaching LAW2295 (Introduction to Cyber Security) and PLCE2130 (Cyber Investigations)

SANS GIAC Advisory Board member

• Led incident response handling and corporate investigation engagements company-wide.• Examined numerous platforms and devices (Windows, Linux, macOS, Android, iOS, BlackBerry, QNX, Cloud).• Crafted meticulous forensic reports for management and stakeholders.• Performed digital forensics around sensitive matters including external/insider threats, data/IP leaks, government/law enforcement.• Regularly presented findings to legal team and external counsel.• Developed… Show more • Led incident response handling and corporate investigation engagements company-wide.• Examined numerous platforms and devices (Windows, Linux, macOS, Android, iOS, BlackBerry, QNX, Cloud).• Crafted meticulous forensic reports for management and stakeholders.• Performed digital forensics around sensitive matters including external/insider threats, data/IP leaks, government/law enforcement.• Regularly presented findings to legal team and external counsel.• Developed forensically-sound methods for local and remote data acquisition (Drive encryption, SIP).• Coded scripts for covert live-response capabilities (Bash, PowerShell).• Built hardware for data acquisition, processing, and recovery.• Deployed and learned commercial and non-commercial forensic tooling (EnCase Forensic, FTK Imager, Magnet Axiom, Arsenal, Cellebrite, BlackBag BlackLight, MacQuisition, Autopsy, SIFT, SOF-ELK).• Researched new forensic artifacts to enrich data and processes.• Assisted with eDiscovery and legal hold preservations. Show less

• Focused on uncovering anomalies and advanced threat actors.• Documented findings and correlated data to define TTPs (MITRE ATT&CK).• Identified blind spots, workarounds, and bypasses.• Coded scripts for automation (EDR, EPP, AV, Big Data).• Automated repeatable workflows and created new methods of threat detection.• Architected offensive security tooling deployment – honeypots/honeynets and anonymous hosts.• Led vulnerability disclosure program and resolved reported… Show more • Focused on uncovering anomalies and advanced threat actors.• Documented findings and correlated data to define TTPs (MITRE ATT&CK).• Identified blind spots, workarounds, and bypasses.• Coded scripts for automation (EDR, EPP, AV, Big Data).• Automated repeatable workflows and created new methods of threat detection.• Architected offensive security tooling deployment – honeypots/honeynets and anonymous hosts.• Led vulnerability disclosure program and resolved reported vulnerabilities. Show less

• Monitored and evaluated malicious activity (PCAP analysis, malware detection, unauthorized access, security policy violations).• Developed processes, procedures, and reporting for management and stakeholders.• Analyzed endpoint and network logs to detect violations of security controls.• Created use cases that support continuous improvement of monitoring and detection capabilities.• Assisted with the support, administration, and tuning of security tools and technologies.

• Monitored security events from various Security Operations Center contact points (SIEM, MSS, tickets, e-mail, telephone).• Escalated incidents from managed service support team to second/third-tier information security specialists.• Guaranteed action of Service Level Agreements.• Provided resolution plans for system and network issues.• Reported common and repeat problems (trend analysis) to management.