At Centrics Networks, I uncovered active C2 beaconing on a compromised legacy firewall through historical log analysis. I escalated my findings and recommendations to the client, enabling the removal of an unauthorized admin account.
I use the MITRE ATT&CK framework for proactive threat hunting, and uncovered and remediated a detection gap for external SMB traffic. I also found an unauthenticated API endpoint exposing client PII on a public-facing web kiosk using Burp Suite, then collaborated with the client on its takedown and patch deployment.
I collaborate with SOC engineering on detection tuning and built custom SIEM detection rules for evil-twin attacks and suspicious double-extension files. I also triage daily alerts across Sophos XDR, CrowdStrike EDR, and SIEM platforms, and provide clients with root cause analysis and remediation steps for high-to-critical incidents.
In my projects, I built and tested Wazuh detection rules for a simulated DLL hijacking attack, using Sysmon and Process Monitor to map behavior and verify alerting. I also simulated DNS tunneling and analyzed malware from a live incident to identify indicators of compromise.
