Work history.

Security engineer and systems builder who designs and owns infrastructure end to end: from architecture down to the deployable config. By day I run a company's security program as the decision-maker (Microsoft Defender, SOC 2 via Vanta, DLP, MDR, vulnerability and patch management); after hours I design and operate a NixOS estate (an on-prem fleet plus a Linode node) as a single source of truth in git, with gated CI/CD, private PKI, centralized observability, and a purple-team loop that proves the detections. Same instincts on both sides: everything as code, least privilege by default, and well-architected tradeoffs between cost, security, and operability. Targeting Solutions Architect / DevOps / Security Engineer / Platform roles.

1. Libra Solutions Group

   Sept 2025 – Present

   Sr. Security Analyst

   • Own the security program as architect and decision-maker: tooling selection, the control architecture across Defender, Vanta, Purview, and MDR, and the tradeoffs end to end.
   • Stood up and operate the Microsoft Defender suite as the core endpoint and threat-protection stack.
   • Designed the SOC 2 control architecture and automated evidence collection in Vanta, mapping technical controls to audit requirements and translating findings for non-technical stakeholders.
   • Designed and stood up the company’s DLP program on Microsoft Purview from scratch: org-wide PII, HIPAA/PHI, and Copilot policies on a phased simulation-to-enforcement roadmap, with operational SOPs for alert triage, tuning, and rollout. Endpoint DLP through Sophos.
   • Manage MDR coverage with Red Canary and Sophos.
   • Own vulnerability management across Qualys, Fortra, and HivePro.
   • Built the server patch-management program in ConnectSecure: a three-ring rollout model (canary → broad production → crown jewels), per-ring scheduler policies, a rollback runbook, and the operator guide and SOPs that let the MSP run it under CAB governance.
   • Work identity-compromise incidents end to end in Defender: credential revocation, sign-in blocks, and forced resets, from alert to closure.
   • Track work and incidents across the Atlassian stack.

2. Self-Directed: Homelab Platform

   2020 – Present

   Infrastructure & SecDevOps Engineering

   • Design and operate a NixOS estate: six hosts (five on UniFi, one on Linode) plus an Ubuntu NAS, all described in a single Nix flake as one source of truth and deployed fleet-wide with one `colmena apply`. Adding a host takes a new directory and one line.
   • Keep provisioning separate from configuration: Terraform stands up the Linode node and its Cloud Firewall, nixos-anywhere + disko handle the greenfield install, and Nix owns everything inside the box. The leg has been decommissioned and rebuilt from the same code — tear-down and rebuild are each one apply.
   • Published a public game server with zero open home ports: the LAN host dials out to the cloud node over WireGuard, nftables DNATs the public port down the tunnel, and the home IP is never exposed. The service itself is declarative — the modpack is pinned into the Nix store.
   • Built a gated CI/CD pipeline on a self-hosted Forgejo Actions runner: nix flake check → gitleaks secret scan → matrix build of every host against a self-hosted Harmonia binary cache → a publish-on-green job that mirrors to a public GitHub repo only after all gates pass.
   • Designed a least-privilege deploy trust model, a scoped `deploy` user that can re-activate a build but never open a root shell, with sops-nix secrets keyed to each host’s SSH host key (no key distribution, no plaintext in the store).
   • Stood up a private PKI with step-ca: an internal CA issuing auto-renewing mTLS certs to ~15 services over its own ACME endpoint, packaged as a reusable NixOS module any host opts into.
   • Run a declarative observability/SIEM stack (Grafana, Loki, Grafana Alloy log shipping, Alertmanager, and ntfy), migrated off Wazuh so detections and dashboards version alongside the config.
   • Retired the fleet’s Tactical RMM/MeshCentral stack once declarative management made it redundant; the config repo replaced the agent.
   • Architected the network, UniFi gateway with VLAN segmentation (trusted / IoT / guest), per-host nftables firewalls, and a WireGuard tunnel to the cloud node, and hardened services with systemd sandboxing and CIS-informed defaults.
   • Operate a purple-team loop on a libvirt/KVM lab (Kali + Parrot via in-browser Guacamole): attack the fleet, confirm the SIEM detects it, then declaratively rebuild the “compromised” host to known-good with one command. Recovery is a rebuild.

3. Kraft Kennedy

   Aug 2022 – Sept 2025

   SOC Analyst, Tier 1

   • Detection-engineering SME for ConnectWise SIEM: authored and curated alert logic across a multi-tenant managed client base, cutting false positives and codifying repeatable detections per environment.
   • Ran incident response end to end across the managed client base (triage, containment with SentinelOne, and zero-trust enforcement with Threatlocker), feeding findings back into detection content.
   • RMM deployment, automation, and management.
   • Email hygiene and journaling with Mimecast.
   • Ticket management in ConnectWise PSA; vulnerability scanning with Tenable.io.

4. Sprout Mortgage

   Feb 2022 – July 2022

   Helpdesk Technician

   • Phishing email analysis and response.
   • Office 365 troubleshooting and support.
   • Ticket and SOP management in FreshDesk.

• University of California San Diego

  Cybersecurity Bootcamp Certificate

• Simi Valley High School

  Diploma

The NixOS estate is public: config as code, see the setup on GitHub, with the running notes in the garden and the published reference architectures, live topology, and a running decision log on the ops page.