I've spent twelve years in cybersecurity, from hands-on incident response and forensics to leading security operations and programs.
Today I lead a security team that serves several regulated organizations at once, brief executives every month, and run incident response when something goes wrong. Along the way I've rebuilt teams, answered to regulators, and learned that most security problems are really decision problems. The technology usually isn't the hard part. Getting the right people to make an informed call, and then following through, is.
This site is where I write about that work, one real situation at a time.
I keep employers, clients, and colleagues out of my writing on purpose. The details are on my LinkedIn and in conversation.
I rebuilt an inherited security team using Situational Leadership II, with a development plan for each analyst, and coached people from doing tasks to owning processes.
I command incident response across business units, IT, security, HR, and executive leadership, and I coach outside responders on containment and escalation.
I brief CEOs, CFOs, and CTOs every month, turn technical risk into decisions they can make, and bring options with real costs rather than a single answer.
I build governance that holds up with examiners and auditors, and I hold managed providers to the outcomes they're paid for.
A few situations from my career, with identifying details redacted. Field Notes tells the full stories.
As security lead, I had put detection in place for exactly this kind of behavior. When WannaCry hit, it flagged a workstation mass-scanning SMB across the network.
Outcome. Stopped at that workstation before it spread.
An attacker flooded a user's inbox, called over Teams pretending to be IT support, and got a malware loader onto the network. I directed my team's response, which caught and contained the loader before any ransomware executed.
Outcome. Avoided an estimated ~$5M, the average cost of an incident from that ransomware group once it's established. That's an estimate, not measured savings.
A penetration tester planted a rogue device on the internal network with no warning to my team. The layered defenses my team built and ran held it off, then flagged it within two minutes of getting on.
Outcome. Four minutes from connection to off the network.
A managed detection provider was sending about 60 alerts a month, 55 of them false positives. I pushed for a standing meeting so they could learn the business and tune. When that didn't fix it, I brought leadership three options instead of one answer.
Outcome. The provider they chose brought it down to about six alerts a month, all of them actionable.
Newest first.
Each certification links to the issuer, so you can check it yourself.
CISSPCertified Information Systems Security ProfessionalVerify with ISC2
GCIHGIAC Certified Incident HandlerVerify with GIAC
GCFAGIAC Certified Forensic AnalystVerify with GIAC
GCFEGIAC Certified Forensic ExaminerVerify with GIAC
GCEDGIAC Certified Enterprise DefenderVerify with GIAC
GSECGIAC Security EssentialsVerify with GIAC
B.S. Computer ScienceRowan University, 2014Want the stories behind all this? Read Field Notes, or find me on LinkedIn.