I build hunting programs that turn adversary intelligence into detections — grounded in MITRE ATT&CK, run against real telemetry, and closed into standing coverage rather than one-off findings
Senior Cybersecurity Defense Analyst with 8+ years of experience specializing in Threat Hunting, Cyber Threat Intelligence, and Detection Engineering. I've established Cyber Threat Intelligence capabilities from scratch, defined the Priority Intelligence Requirements that keep them relevant, and led intelligence-driven hunting campaigns that translate adversary research into new detection coverage across Microsoft Sentinel and Defender XDR. Alongside the technical work, I mentor analysts and share hunting methodology as security operations teams mature.
Reverse-chronological, from first SOC role to current threat hunting leadership.
Leading the evolution of the organization's Threat Hunting program: hunting methodology, detections informed by adversary TTPs, and mentoring analysts as the Cyber Defense team's capability matures.
Established and operationalized the organization's CTI capability — PIRs, strategic and tactical advisories, adversary profiling, and intelligence-driven hunting campaigns that fed directly into Sentinel detection improvements.
Primary escalation point for Level 1 analysts; investigated incidents across Defender, Carbon Black, and ATA, and led post-incident reviews to improve response process.
24/7 MSSP SOC — tuned SIEM detections against MITRE ATT&CK, managed log source onboarding, and led customer-facing reviews against client risk objectives.
Managed enterprise DLP, led vulnerability management, and coordinated penetration testing across international teams.
Organized the way I organize a hunt program: by capability area, not job title.
The framework I use to turn a Priority Intelligence Requirement into a testable hunting hypothesis — and, when it succeeds, a standing detection.
"Let's hunt for lateral movement" is a topic, not a hypothesis. A Priority Intelligence Requirement — e.g. "are we likely to be targeted by ransomware affiliates using exposed RDP?" — keeps the hunt tied to real organizational risk.
Take a well-documented actor's known techniques — initial access, discovery, lateral movement, defense evasion — and map each to the PIR at hand.
The behavior, the expected telemetry, and the condition that would prove or disprove it. A testable hypothesis makes even a "nothing found" hunt informative.
A hunt that finds something once and is never operationalized is a missed opportunity. Successful hunts become tuned KQL analytics in production.
Document what was hunted, what was found, and what changed in detection coverage — the real measure of hunting maturity over time.
Recognized for outstanding contributions to cybersecurity initiatives, operational excellence, and organizational impact.