Incident Response
Lead high-sensitivity investigations, coordinate escalation, and own the response lifecycle through closure.
- Triage
- Containment
- Root cause
- Post-incident reporting
Cybersecurity Engineer · Washington DC
Defending what matters.
I investigate complex threats, strengthen enterprise defenses, and turn security signals into decisive action. My work spans federal and private-sector environments, grounded in more than a decade of hands-on cyber defense.
10+Years in cybersecurity
24K+Vulnerabilities managed monthly
1.2K+Security incidents managed monthly
200+Malicious indicators blocked
01 / Core expertise
Security expertise built in live environments.
My approach connects technical depth with operational judgment—from the first alert through containment, remediation, and executive reporting.
Threat Intelligence
Enrich indicators, connect attacker behavior to campaigns, and translate intelligence into proactive defenses.
- IOC analysis
- Threat hunting
- OSINT
- Campaign analysis
Vulnerability Management
Prioritize exposure through risk, threat context, and asset criticality—then validate remediation at scale.
- Nessus
- CVSS
- Patch validation
- Risk reduction
Security Engineering
Strengthen endpoint and network controls across complex enterprise and federal technology environments.
- Palo Alto
- Microsoft Defender
- SentinelOne
- Splunk
02 / AI-assisted cyber defense
AI-Assisted Cyber Investigation and Incident Response
As threat actors increasingly use artificial intelligence to accelerate reconnaissance, social engineering, phishing, and other malicious activities, cybersecurity defenders must also use AI to strengthen their detection and response capabilities. AI can help analysts process large volumes of security data, correlate related activity, identify patterns, and investigate potential threats more efficiently.
However, AI should support—not replace—analytical judgment. I use Microsoft Security Copilot to accelerate investigations while independently validating its findings against the original security telemetry. Every determination remains evidence-based, whether an alert is ultimately classified as a true positive, false positive, or inconclusive.
01Phishing Email Investigation
02Incident Response Investigation
03Network Activity Investigation
04Malware Investigation
05Unauthorized Access Investigation
06Identity & Sign-In Investigation
Additional applications: threat hunting and alert correlation.
03 / Selected work
Cybersecurity concepts, mapped for action.
These visual frameworks translate complex investigations into clear, repeatable workflows for analysts, defenders, and security leaders. Select either image to view it in full detail.
Cybersecurity Investigation Mind Map
An evidence-driven, end-to-end model covering alert triage, evidence collection, threat hunting, determination, containment, reporting, and lessons learned.
View full mind map ↗Microsoft Security Copilot for SOC
A simulated investigation workflow demonstrating responsible AI-assisted triage, evidence validation, KQL generation, response decisions, and documentation.
View full mind map ↗04 / Credentials
Academic insight. Operational depth.
I combine advanced research in cybersecurity leadership with industry certifications and day-to-day experience defending real systems.
Education
PhD in Cybersecurity LeadershipCapitol Technology University · In progress
MS in Cybersecurity TechnologyUniversity of Maryland Global Campus · GPA 4.0
BS in Cyber SecurityUniversity of Maryland Global Campus
Certifications
AWS Certified Security – SpecialtyAmazon Web Services
Certified Information Security ManagerISACA · CISM
Certified Information Systems AuditorISACA · CISA
CompTIA Security+ ceCompTIA
SplunkMicrosoft SentinelDefender for EndpointSentinelOneCrowdStrikePalo Alto NGFWCortex XDRNessusElasticRecorded FutureVirusTotalAnyRun
05 / Connect
Let’s strengthen the next line of defense.
For cybersecurity leadership, engineering, research, or collaboration opportunities, connect with me on LinkedIn.