• Monitored and responded to enterprise security events using SIEM tools, improving detection and response efficiency.
• Conducted regular vulnerability assessments and penetration testing, prioritizing risks and driving remediation with IT and development teams.
• Led incident response activities for malware, phishing, and insider threats, including investigation, containment, recovery, and root cause analysis.
• Developed and maintained comprehensive KQL detections in Microsoft Defender to enhance alert accuracy and reduce false positives.
• Performed proactive threat hunting using endpoint telemetry, behavioral analytics, and threat intelligence to identify potential security breaches.
• Implemented deception technologies to detect lateral movement and targeted attacks.
• Conducted digital forensics and e-discovery investigations in compliance with legal standards.
• Built SOAR playbooks to automate triage, enrich alerts, and improve response workflows.
• Collaborated cross-functionally with IT teams to deploy security controls, expand monitoring coverage, and enhance organizational security posture.
• Developed and maintained security policies, incident response playbooks, and detection documentation for consistency and knowledge sharing.

c0wsec Honeypots

Architect and deploy the physical and virtual infrastructure required for a global honeypot solution. Lead multiple teams related to infrastructure, deception strategy, and threat modelling to ensure a successful deployment.

Opnsense · tailscale · ansible · terraform · proxmox · deception technology

Threat Intelligence Dashboard

Design and develop a modern threat intelligence dashboard using react and typescript. Utilize the latest tools and technologies for the tech stack to ensure a modern flow of the site. Correlate and visualize the relationships between multiple data points like IOCs and vulnerabilities. Pull the latest CVE data for vulnerability management of other projects and their tech stacks.

React · Typescript · Convex · Clerk · Bun