Daniel Nunez

I've supported defensive cyber operations for the U.S. Army, investigating threats across enterprise, cloud, and OT/SCADA environments. I turn host and network telemetry into incident timelines, analytical storyboards, and actionable recommendations for senior leadership.

As a Senior Specialist, I lead a five-person analyst team, coordinate technical reporting, build analyst training, and manage readiness for $250M in government-owned technical equipment.

Previously, I conducted incident response involving PLCs, HMIs, and engineering workstations, using Arkime, Malcolm, and Kibana to reconstruct adversary activity and investigate indicators of compromise. I also built dashboards and visualizations that streamlined case development and strengthened reporting.

Over more than five years of threat hunting, I've used Splunk Enterprise, Security Onion, SPL, and KQL to analyze large-scale telemetry, map adversary TTPs to MITRE ATT&CK, develop detection coverage matrices, and share actionable findings with defense and intelligence stakeholders.