Security practitioner with 7+ years across IT operations and security. Founder of Cyber Obsidian, a managed security and IT practice helping small businesses improve endpoint protection, monitoring, and incident readiness — Google Workspace security monitoring, SentinelOne EDR, incident investigation and reporting. U.S. Citizen · Clearance-Eligible.
New York metro · Remote · Open to relocation (Northern Virginia / DC)
Seven-plus years across IT operations and security — currently running a managed security practice end to end.
Managed security for small-business clients — Google Workspace security monitoring, SentinelOne EDR, phishing and spoofing detection, endpoint threat containment, and incident response.
Tier 3 escalation point after Help Desk Tier 1/2 intake — 4,956 tickets per year at a 99% resolution rate, resolved within a 24-hour SLA in ServiceNow. Carries post-resolution CSAT accountability across the full ticket lifecycle, alongside Canvas LMS administration, LTI integrations, and third-party vendor evaluation.
Cross-platform IT support — hardened Windows, macOS, and Linux endpoints with security baselines and least-privilege controls, resolved server and network issues, and led database migrations.
Hands-on security engineering — detections built, attacked, and validated in a purpose-built lab, plus tooling for real incident-response workflows.
Purpose-built Wazuh SIEM lab that tests what a default deployment actually catches — ran Atomic Red Team tests mapped to MITRE ATT&CK, confirmed three detection gaps, and closed them with real-time File Integrity Monitoring and a custom auditd-backed correlation rule, each validated by re-running the attack.
Segmented VLAN network on pfSense with Twingate zero-trust access and Quad9 DNS filtering, paired with a virtualized SOC lab on Proxmox — Wazuh SIEM, adversary emulation with Atomic Red Team, and custom MITRE ATT&CK-mapped detection rules.
Production Next.js 16 / TypeScript site for my MSSP, hardened end to end: CSP and full security-header set, server-side Turnstile bot verification, input validation with header-injection defense, rate limiting, and RFC 9116 security.txt. Architecture public, source private.
View Repo →GitHub Actions pipeline enforcing four merge-blocking security gates — SAST (Semgrep), dependency scanning (pip-audit), secret scanning (Gitleaks), and container image scanning (Trivy) — around a Python hash-identification CLI. Found and triaged 23 HIGH/CRITICAL findings (12 unique CVEs) in the base container image, confirmed via Trivy's Fixed Version output that no patches existed, and documented the accepted risk in a dated .trivyignore rather than silencing the gate. Enforcement is real: GitHub branch protection requires all four checks to pass, verified with a live test pull request.
View Repo →Phishing email analysis and campaign-results interpretation — identifying at-risk teams and building a targeted security-awareness training plan.
View Repo →Security research analyzing input-capture techniques (MITRE ATT&CK T1056.001) with a focus on detection via Sysmon and SIEM telemetry.
View Repo →The stack I work with daily — across detection, identity, network defense, scripting, and cloud.
I'm actively pursuing SOC Analyst, Cloud Security, and DevSecOps roles. If you're a recruiter or hiring manager, reach out on LinkedIn — I respond quickly to connection requests with a note.
New York metro · Remote · Open to relocation (Northern Virginia / DC)