At NINJAONE, I built incident response, threat hunting, and detection engineering capabilities from a low-maturity baseline, establishing investigation standards and expanding coverage to global 24×7 operations.
I operationalized Panther and Splunk workflows across AWS, endpoint, identity, and SaaS telemetry. I also developed detection logic for malicious RMM platform abuse, partnering with Product Engineering to add telemetry that enabled a production alert 17 minutes after an actor onboarded an endpoint.
I led investigations and response coordination across 50+ security incidents, and established investigation SOPs and evidence-validation practices. I applied Python utilities and workflow automation to investigations and led adoption of version-controlled detection practices and AI-assisted SIEM/SOAR workflows.
At UNITED STATES AIR FORCE, I engineered detections and sensor rules for endpoint, network, and web application threats, and conducted incident response and threat hunting in an enterprise environment of approximately 900,000 endpoints. My active certifications include CompTIA Security+, Network+, A+, and ITIL 4 Foundation.
