Seven-plus years leading IT operations and 24/7 escalation teams, now moving into hands-on SOC and DFIR work. CompTIA CySA+ and Security+ certified, with real time in SIEM detection engineering (KQL across Splunk, Sentinel, Defender, and ELK), network and PCAP analysis, and incident response, including GDPR-scope PII breach containment. Placed 7th out of 192 in a DFIR CTF, and built the rest of this the same way: home labs instead of slides, tools that run instead of diagrams, and writeups that show the actual methodology behind a result, not just the flag or the finding.
Focus
Detection engineering, threat intelligence, DFIR, and cloud security. I care more about evidence, timestamps, and retest steps than about checklist-driven training.
How I work
I build lab environments first, then test detections and response paths against them. Most of what's on this site comes from that cycle: build something realistic, break it, detect it, write it up.