Malware analysis, DFIR, threat intelligence, and detection engineering.
Four years of security engineering for the USAF — incident response and malware analysis in an enterprise SOC — plus three years of SIGINT analysis at NSA. Building toward detection engineering and security tooling. Separating in 2027.
Security engineer with four years in USAF cyber operations and three years of SIGINT analysis at NSA. Currently NCOIC of a forensics and malware analysis element supporting 24/7 defensive operations across Air Force's Information Network. Active TS/SCI clearance with a CI Poly. Hold the following certifications: GREM (malware analysis), GXPN (exploit research/advanced pentesting), GCFA (host analysis), GNFA (network analysis), Security+
I build security tooling and detection content in Python and am also learning Go for zero-dependency tools.
Pursuing a B.S. in Software Engineering at WGU, expected December 2026. Separating from the Air Force in 2027 and relocating to California for a detection engineering or security engineering role.
Detection-as-code testing harness. A pytest harness generates one test case per Sigma rule at collection time, with fail-fast validation that makes it structurally impossible to ship a rule without its tests. Rules are validated against captured attack telemetry with exact event-level assertions — fire on labeled attack indices, and nowhere else. GitHub Actions CI gates every commit.
Python CLI that converts unstructured threat-research text into deterministic structured threat intelligence. A Pydantic schema serves as single source of truth — it generates the tool's input_schema and validates the response, eliminating drift between API contract and parser. Forced tool-use on every call; malformed model output raises an explicit ValidationError rather than silently returning. Source provenance and extraction metadata travel in the output envelope.
Modular macOS forensic artifact collector. Eight independent modules covering persistence mechanisms, process snapshots, code signing metadata, TCC permissions, extended attributes, and Unified Log activity. Modules declare dependencies as metadata and never import each other; anomaly flags surface writable paths, EUID/RUID mismatches, and unsigned binaries. Zero third-party dependencies, read-only collection model.
Format-agnostic static analysis pipeline for malware triage. Extracts file hashes, printable strings, and IOC patterns — IPs, URLs, domains, file artifacts — via a two-pass modular extractor architecture. Outputs deterministic, deduplicated JSON for downstream automation.