Security engineer: detection, identity and security operations
I've worked in corporate IT, security operations and security engineering for more than ten years. I built one company's IT and security function as its first internal owner, ran Okta and endpoint security, led incident response, and reworked SIEM detections to cut alert volume by about 30%.
Right now I'm a contract security engineer, investigating identity, endpoint, phishing and fraud activity. I use Claude Code to speed up investigations, and people still make the consequential decisions.
On my own time I run a security lab with Okta, Elastic, Terraform and an AI triage agent. I use it to test ideas end to end, and I write up what worked and what didn't.
Experience
Security Engineer (contract) a fintech company · 2026–present
Investigate identity, endpoint, phishing and fraud activity. Tune SIEM detections and triage workflows.
Senior Security Engineer (contract) Vera Therapeutics · 2025–2026
Owned security engineering across endpoints, infrastructure and cloud services. Led a vulnerability management platform from proof of value to rollout, and led the ZTNA and CASB evaluation.
Cyber Engineer / Analyst Armis · 2022–2025
Helped build and run security operations, including implementing Elastic SIEM. Reworked SIEM detections, cutting alert volume by about 30%. Implemented DLP controls that cut exposed storage files by 50%. Incident commander and sole responder for the FedRAMP GovCloud environment.
Corporate Security Engineer Demandbase · 2021–2022
Restructured Okta around joiner-mover-leaver workflows, SSO and MFA, group-based access and recurring access reviews. Ran endpoint security with Jamf, Intune, SentinelOne and Red Canary.
Earlier
SOC analyst at PG&E (regulated 24/7 SOC), first IT and security owner at Peerspace, senior IT engineer at Indeed, IT support at Varsity Technologies.
Full experience on the About page →
Featured work
-
From identity attack to investigated alert
One password-guessing test followed end to end: Okta, Elastic, a detection, AI triage with personal data kept out, and a verdict in Slack. Six steps ran live; the approval step is designed, not built.
-
Keeping personal data out of an AI triage agent
My first design hid only the values I'd listed, and it leaked twice. Stand-ins now replace every address, place and outside email before the model or Slack sees them.
-
An MFA fatigue detection, and the test data I guessed wrong
A push-bombing rule as code, tested in CI. One real push showed my test data used the wrong event for a denial.
-
Missing logs that weren't missing
A log line said events were being dropped. I wrote up a root cause, then measured it and found I was wrong.
Tools
- At work: Okta, Entra ID, Google Workspace, Microsoft 365, SentinelOne, CrowdStrike Falcon, Red Canary, Jamf, Intune, Datadog SIEM, Elastic SIEM, Splunk, QRadar, XSOAR, Torq, Claude Code
- In my lab: Elastic, Sigma, Terraform, Python, Docker, Claude API and MCP