Work
Each case study covers the setting, the decisions and their trade-offs, and where the work stands today. Employers are described by industry. Detail that would map a client's environment stays out.
- Claim:
Built the security and compliance program at a US defense contractor of about 80 users, as its first security hire.
US defense contractor, November 2025 to now
Evidence:Brought the commercial environment up to the CMMC Level 1 practice set, designed an enclave-based CUI boundary for Level 2, wrote the SSP against NIST SP 800-171 and set up an ISO/IEC 27001:2022 ISMS with internal audit.
- Claim:
Moved a business from Google Workspace to MS 365 across three mail domains, and rebuilt the identity baseline on the way.
US defense contractor, August to October 2026
Evidence:78 user and 17 shared mailboxes, about 1.8 TB, migrated with MigrationWiz into one tenant. Security Defaults replaced mid-migration by a five-policy Conditional Access baseline with break-glass accounts.
- Claim:
Designed an on-prem SIEM and DFIR stack that one engineer can run, on servers the business already owned.
US defense contractor, 2026
Evidence:Wazuh all-in-one with Sysmon on every Windows endpoint, five event channels, MITRE-mapped custom rules and FIM. TheHive, Cortex and MISP for case handling. KAPE and THOR Lite for triage. A 19-section build manual covers the stack end to end.
- Claim:
Brought an unmanaged Windows fleet under control through RMM scripting, then designed tiered access so each group gets only what its work needs.
US defense contractor, 2026
Evidence:Fleet-wide PowerShell remediation through Action1 removed unapproved remote-access tools and software, audited local admin sprawl and collected Windows 11 readiness and Autopilot data. Conditional Access tiers set by role, location and device.
- Claim:
Wrote and maintain an open-source Windows 11 hardening and triage tool in which every change is backed up and reversible.
Independent open source, 2026 to now
Evidence:A PowerShell 5.1 GUI with a security audit and tiered fixes, debloat, a plain-English compromise check and a native process and event-log hunt. Restore point, JSON before-state, rollback script and verify-after-apply on every change.