How I Got Here
I started at the help desk. Moved through systems engineering and network security, then into the SOC. I love all of it. Working alerts, hunting through telemetry for things that tools miss, writing detection rules that actually catch real threats. I'm not trying to pick one lane. Threat hunting, detection engineering, SOC operations, they all feed each other and I want to be good at all of them.
At Red Canary I hunted full time across major EDR platforms. Found a threat actor with a 2-month undetected VPN compromise running AD brute force. Identified FIDO downgrade attacks in Entra ID, malicious LNK files pointing to C2, and infostealers like Chihuahua Stealer. I got to take real hunts and work with the detection engineering team to convert them into production rules.
Now I'm at Secnap Network Security where I wear a lot of hats. I write custom detection rules for Windows, M365, Entra ID, and Google Workspace in LimaCharlie, converting Sigma rules into the platform and writing new ones from scratch. Mac and Linux coverage is next. I've built the entire customer portal, SOC dashboard, workflow system, and response processes using PHP, MySQL, and the LimaCharlie API. I lead the SOC team handling incidents and escalations, I'm building out the threat hunting function, and I run customer-facing product demos and work directly with customers on incidents and questions.
I'm not a developer by background, but I've gotten hands-on building the tools our team needs. I like solving problems and I like building things that make security operations better.