I'm a security engineer who secures the technology a hospital runs on — endpoints, identity, network, and the SIEM that watches it all. Full-stack defensive coverage, proven in an environment where downtime isn't an option. This page is that work, monitored live.
The same coverage a security program needs — endpoint, identity, network, detection, vulnerability management, and governance — each one real work I own in production. Green is holding. Amber is active.
6 domains returned
Run audits that correlate logs across Horizon event data, Imprivata, badge systems, and FortiAnalyzer, and write KQL to surface what matters in Sentinel. Pulling a clean signal out of scattered sources is the core of the work.
Researched and implemented mitigations for Rapid7 penetration-test findings and eliminated critical Active Directory Certificate Services vulnerabilities — measurably improving the security posture of the environment.
Built role-based provisioning tying badge and system access to AD security groups: new hires get the right access automatically, terminated accounts lose it the instant they're offboarded. Identity lifecycle that enforces itself.
Audit accounts and access through Microsoft Purview and participate in internal investigations — defensible collection and review handled cleanly, the part of security that has to hold up under scrutiny.
Standardize and harden 10ZiG endpoint templates so every deployed device is secure and consistent, and lock down medical devices — Technician-ID auth, idle lockouts, and compensating-control documentation where they can't meet the standard natively.
Own the firewall HA pair and edge, pull forensic detail from FortiAnalyzer, and work across Azure and M365 daily. Turning "the network is slow" into an actual diagnosis is a security skill before it's a networking one.
The same floor, walked longer. A pattern of taking senior-scope work without waiting for the title to catch up.
5 events · ordered desc
Certifications and the working toolset. Amber items are in progress.
12 rows · grouped by status
Shipped code, not just coursework. Each one links to the repository.
5 repos · sorted by category
Stood up a live honeynet and security operations center — Azure VMs feeding Microsoft Sentinel, with Log Analytics surfacing real attack telemetry.
End-to-end ML pipeline in Python — data analysis, SQL, and scikit-learn models built and evaluated in Jupyter.
A delivery-routing engine built on hand-implemented data structures and algorithms in Python.
A full JavaFX desktop application — data management, software design, and a complete UI.
An Electron desktop app I built to replace a paid badge-printing license — same output, zero license cost. It prints every new hire's first badge and still runs in production.
This pulls the real CISA Known Exploited Vulnerabilities catalog — the authoritative "patch this first" list of CVEs under active exploitation. It's the feed I'd actually watch in a vuln-management role, live from CISA's catalog. Filter by ransomware association below.
externaldata(cveID:string, vendor:string, product:string, dateAdded:datetime, ransomware:string)
[@"https://www.cisa.gov/.../known_exploited_vulnerabilities.json"]
| where dateAdded > ago(90d)
| where ransomware in ("Known","Unknown")
| order by dateAdded desc
—
I'm targeting security operations, ISSO, and vulnerability-management roles. Here's what I bring that a narrower candidate can't.
Hands-on Sentinel and KQL, correlating logs across Horizon, Imprivata, badge systems, and FortiAnalyzer. I've done real multi-source audits, not lab exercises.
Rapid7 and Qualys findings worked end to end — including eliminating critical AD CS vulnerabilities. I close findings, not just report them.
IAM, Purview audits, investigations, HIPAA, and change control. The breadth ISSO work actually demands — and I've operated across all of it in production.
I secure medical devices and clinical systems most security teams treat as a black box. That domain context is a hard-to-hire edge, and I live in it daily.