- Administer EDR for over 3,900 endpoints; led migration from legacy AV to Microsoft Defender for Endpoint.
- Subject-matter expert and service owner of Globalscape EFT (critical file ingress/egress); completed multi-phase remediation and hardening for EFT, IIS sites, and BIG-IP load-balanced services. Boosted agency’s BitSight score by over 100 points.
- Global administrator for the agency’s Microsoft Entra ID tenant; on-call contact for Windows Server, Active Directory, and EFT.
- Led infrastructure upgrades and migrations (load balancers, SIEM, server in-place upgrades, Windows Hello for Business) — document change management procedures.
- Perform incident response and SOC reporting; create and maintain playbooks for BEC, PUPs, and other common security incidents; cross-train staff for 24/7 coverage.
- Researched malware analysis techniques as it pertains to the generalization of malware datasets to unforeseen malware specimens across multiple families.
- Collaborated with a team of 10 to teach and prepare instruction material for an active cyber defense class.
- Taught students how to secure common services on Linux machines.
- Provided instruction on common web vulnerability exploitation techniques such as SQL injection and cross-site scripting.
Tutor
-
Wyzant
Nov 2020 - present
I provide tutoring services to students on Wyzant, mostly in topics related to Computer Science and Cybersecurity.
- Conduct research on malware analysis in the large.
- Adopt a data science-driven approach to discovering malicious code.
- Worked with a team of 3 to write a Ghidra plugin that automates static analysis of raw binaries.
- Trained a machine learning model to identify and distinguish malicious and benign functions within malware from extracted features.
- Performed incident response and penetration testing on the county’s production network (supports a $5B annual budget); collaborated with industry-recognized security experts.
- Translated penetration-test findings into risk and business-impact analyses and researched exploit paths to improve remediation.
- Implemented IR procedures via the county SIEM, asset & vulnerability management, and help-desk systems; automated administrative IR tasks.
- Built real-time SOC displays from IR and VM processes; administered MongoDB for production network traffic monitoring.
- Conducted malware analysis using OSINT, Wireshark, and multiple sandbox environments; configured Ubuntu servers to collect internal asset data and monitor malicious hosts.
- Updated and documented the IR plan aligned to NIST SP-800 guidance; wrote Python API scripts to streamline IR workflows.
