Chicago, IL · Open to remote
I turn attacker behavior into detections that hold up in production, secure cloud identity at the hybrid seam, and automate the response work that shouldn't wait on a human.
IT Security Associate running security operations across five affiliated healthcare entities. Seven years across IT operations and security, specializing in detection and response in the Microsoft stack — Entra ID, Defender, and Sentinel.
I came into security from the operations side, and it shaped how I work. Five years running IT for a growing business meant administering the systems — cloud identity, endpoints, networks — that security teams later ask questions about. When an alert fires now, I already understand what sits underneath it.
Today I handle security operations for a healthcare revenue management company spanning five affiliated entities, each with its own domain and Microsoft 365 tenant. The work is alert triage and investigation, identity governance in Entra ID, endpoint security, and a steady stream of automation aimed at the processes where a missed manual step becomes a security gap. Working in a HIPAA-regulated environment means every control has to be documented as well as functional.
I'm deliberately specializing in detection and response engineering with a cloud and identity focus. Most of my learning goes into KQL, Sentinel architecture, and identity attack paths — and I write up what I figure out on my blog.
Physicians Revenue Group, Inc. · Downers Grove, IL
Alshaheen Perfumes · Plainfield, IL
An offboarding ticket now triggers the full identity teardown automatically: the Entra ID account is disabled, active sessions are revoked, licenses are reclaimed, and the outcome is written back to the ticket as an audit trail. Closes the window where a departed employee still holds a valid token — the gap manual offboarding always leaves open.
An endpoint security alert flagged possible Log4Shell exploitation. I wrote a PowerShell investigation script, deployed it through RMM to enumerate Java runtimes and Log4j artifacts, and established the host had neither — it was not exploitable. Traced the flagged source address to the network's own DNS gateway. Documented as detection of scanning traffic, not a compromise.
Silent install and upgrade tooling for endpoint protection across a distributed fleet, hardened through repeated real-world failure modes — partial installs, stale agents, and hosts where the installer ran without a user context. Turned an unreliable manual rollout into a repeatable one.
A growing PowerShell toolkit for identity questions the portal answers slowly or not at all: reconciling directory users against authoritative HR data, resolving Entra object IDs from Windows security events during local administrator group investigations, and reporting license and service plan state by stable GUID rather than fragile display names.
Two internal web applications built end to end: an asset management system in Flask for hardware lifecycle tracking, and a shipment tracking portal in Node.js and Express with JWT authentication, four-tier role-based access control, carrier API integration, and activity logging throughout — backed by a 200+ test suite. Security engineers who can read and write real applications make better decisions about them.
A hybrid lab — on-premises Active Directory synced to Entra ID, endpoints reporting into Sentinel and Defender — used to run attack techniques, observe the telemetry they generate, and write detections against them. Every technique ends with a tested rule and a write-up on the blog.
Microsoft Entra ID, Azure AD, Active Directory, hybrid identity, MFA, Conditional Access, Microsoft Graph, identity lifecycle and governance
Microsoft Defender XDR, Microsoft Sentinel, KQL, SIEM triage and investigation, EDR operations, alert tuning, incident documentation
PowerShell, Python, JavaScript, n8n, REST and Graph APIs, Bash, webhook orchestration, SOAR patterns
Nessus, OpenVAS, OWASP ZAP, Nmap, Wireshark, vulnerability triage and remediation, traffic analysis
Microsoft 365, Azure, Intune, AWS fundamentals, Windows Server, virtualization, endpoint management
MITRE ATT&CK, NIST CSF, OSSTMM, HIPAA-regulated operations, incident response lifecycle, OWASP Top 10, SOP authoring
Master of Science
Western Governors University
Bachelor of Science
University of Illinois Chicago
Open to conversations about detection engineering, security operations, and cloud identity roles — remote preferred. Corrections on anything I've written are always welcome too.