I have a habit of pulling on threads until I understand exactly what happened and why. That tendency — useful in IT, essential in security — is what pushed me from managing infrastructure toward investigating threats.
Outside of work, I volunteer with Guardian Group on Project 1591® — doing passive OSINT investigations to help identify underage trafficking victims for U.S. law enforcement. It's painstaking, sometimes heavy work, and it's the work I'm most proud of. It's also shaped how I think about investigations, evidence, and what it actually means to find something hidden in plain sight.
I'm also neurodivergent and I've spent a long time figuring out how to make that work for me in a high-pace technical career rather than against me. I write about that too, because it doesn't get talked about enough in this industry and it probably should.
This site is where I document what I'm learning: IR walkthroughs, OSINT research, homelab builds, tools I actually use, and occasional honest writing about what it's like to do this work as a human being. If you're a practitioner, I hope something here is useful. If you found your way here for the other stuff — you're welcome here too.
- Led full investigation of a macOS infostealer (InstallFix malvertising campaign) — reconstructed a 6-phase attack chain from EDR telemetry within 96 seconds of initial execution, including credential exfiltration and cloud token theft
- Architect and enforce Zero Trust identity controls across 300+ endpoints: Conditional Access, SSO (SAML/OIDC), Windows Hello for Business, passkeys, and PSSO via Microsoft Entra ID
- Drive SOC 2 Type II, ISO 27001, and TISAX compliance — owning technical controls, audit evidence, and policy documentation end-to-end
- Selected, deployed, and operationalized Automox and SentinelOne as the organization's patch management and EDR stack — still running both today
- Built the identity governance foundation: initial Zero Trust CA policies, SSO integrations, and lifecycle automation that cut provisioning time by 40%
- Promoted twice in 7.5 years — from Service Desk to Sysadmin to Senior — for technical excellence and ownership of security initiatives beyond the role
Compliance
Access Mgmt
Management
Scripting
& OSINT
& OS