Cybersecurity Professional CISSP Penetration Tester
Started in IT. Figured out the security problems were more interesting. Haven't looked back since.
IT background. Security focus. Genuinely curious about how things break.
I came up through IT and networking. Somewhere along the way I realized the more interesting question wasn't how to keep systems running. It was how someone would get in if they wanted to.
That shift led me to security full time, backed by a Master's from Trine University and a Bachelor's in Cyber Defense from Davenport University. I work across security architecture, penetration testing, and GRC, helping organizations understand their real exposure and not just their audit score.
Trine University
Information Security & Technology Management
Davenport University
Cyber Defense & Security Operations
The best time to find a vulnerability is before someone else does. I lean into threat modeling and red-team thinking so organizations stop playing catch-up with adversaries.
NIST and ISO 27001 aren't just there to make your auditor happy. They're blueprints for actually reducing risk. I help turn compliance requirements into controls that hold up in the real world.
You can have perfect tooling and still get phished by a fake invoice. Security culture is the layer that makes everything else work, starting with making sure every person in the org knows their role.
Deep technical knowledge paired with strategic thinking across the full security lifecycle.
Designing layered, defense-in-depth security architectures that align with business objectives and scale with organizational growth.
Conducting authorized offensive security assessments to identify vulnerabilities before malicious actors can exploit them.
Translating complex regulatory frameworks into actionable security programs that satisfy auditors and reduce real-world risk.
Applying machine learning techniques to threat detection, anomaly detection, and security automation while securing AI systems themselves.
Collecting, analyzing, and operationalizing threat intelligence to inform defensive posture and proactive countermeasures.
Leading coordinated responses to security incidents - from initial detection through containment, eradication, and post-incident review.
Validated expertise across security domains, governance, and offensive security practices.
CISSP
Certified Information Systems Security Professional
(ISC)²
CC
Certified in Cybersecurity
(ISC)²
Security+
CompTIA Security+
CompTIA
PenTest+
CompTIA PenTest+
CompTIA
CNVP
Certified Network Vulnerability Professional
CompTIA
CPT
Certified Penetration Tester
GAQM
IBM
IBM Cybersecurity Certification
IBM
Proofpoint
Proofpoint Security Certification
Proofpoint
XM Cyber
XM Cyber Attack Path Management
XM Cyber
9 active certifications across 5 issuing bodies
Practical tools built to demonstrate applied security concepts - not demos, actual things you can use.
Practical perspectives on security architecture, emerging threats, and building resilient programs.
Industrial control systems run refineries, water treatment plants, and power substations. Testing their security requires a methodology that looks nothing like a standard network assessment, and applying the wrong one can take down a production line.
Most companies send security questionnaires to vendors as a form of due diligence. What they get back is a compliance artifact, not an assessment of risk. Here is what the questionnaire is actually measuring and what to do instead.
Most organizations treat a SIEM license as a detection program. It is not. Detection engineering is the discipline of writing, testing, and maintaining detection logic tuned to your environment, and vendor-supplied rules are not a substitute for it.
Turning your company's sensitive data into vector embeddings does not make it safe. Embeddings are more reversible than most practitioners assume, and vector stores are typically missing the access controls your relational databases take for granted.
Most web application penetration tests are commissioned with the right intention and structured in a way that makes them significantly less useful than they could be. Scoping is where value gets lost, before the tester ever opens a browser.
Security operations teams that rely entirely on alerts are making a bet that their detection coverage is complete. It is not. Threat hunting is what you do when you assume the attacker is already there and set out to prove it, before the alert fires.
PCI DSS 4.0 became mandatory in March 2024 and it is not a cosmetic update. MFA requirements expanded significantly, targeted risk analyses became required work, and organizations that treated the transition as a documentation exercise are finding out what they missed during their first formal assessment.
Kubernetes ships with defaults that prioritize getting things running over keeping them secure. Most clusters in production are running on those defaults. Here is what that actually looks like from an attacker's perspective and what a reasonable baseline requires.
Cloud environments violate most of what traditional incident response assumes. There is no disk to image, no cable to pull, and the evidence that exists is ephemeral. Here is what IR actually looks like when the incident is in AWS.
Organizations are rushing to fine-tune AI assistants on internal documents, support tickets, and HR data. The model does not just learn from that data - it memorizes parts of it. Training data extraction is a documented attack technique, and most internal AI deployments have not accounted for it.
M&A due diligence covers financials, legal, and operations with rigor. Security usually gets a questionnaire. The acquiring company finds out what was actually on the target's infrastructure after the deal closes, which is the worst possible time to find out.
Purple teaming is what happens when you stop treating offensive and defensive security as separate departments running separate exercises. It is the fastest way to find out whether your detection coverage actually works before a real attacker demonstrates that it does not.
Expired TLS certificates cause production outages that have nothing to do with attackers. Most organizations manage thousands of certificates with spreadsheets and panic. Here is what certificate management looks like when it works and why it almost never does.
Business email compromise does not look like a security incident until the wire is already gone. The response runs on a different clock than every other incident type, and the urgent action in the first two hours is financial, not technical.
Most AI security thinking was built around chatbots that generate text. Agentic AI systems can query databases, send emails, execute code, and spawn sub-agents. The attack surface is different, the failure modes are different, and the security frameworks most teams are applying are not adequate.
Most organizations buy cloud penetration tests and get network assessments with cloud-flavored findings. The attack surface in AWS, Azure, and GCP is API-driven and IAM-centric, and the methodology that actually finds the dangerous paths looks nothing like a port scan.
Most organizations treat cyber insurance as a financial backstop for incidents their security program failed to prevent. Insurers increasingly see it differently. The gap between those two perspectives is where claims get denied.
Ransomware response is not one decision. It is a sequence of decisions that interact, each made under time pressure with incomplete information. Most organizations have not thought through any of them before needing to make all of them at once.
Modern attackers bypass hardened production environments by targeting what generates them - the build pipeline, package dependencies, and CI/CD tooling. Most engineering organizations are running completely blind to this attack surface.
The most common path to domain administrator in an internal network assessment is not a zero-day exploit. It is a series of configuration gaps that exist in almost every Active Directory environment. Here is how that path works and what it looks like from the other side.
Machine learning has become the backbone of modern security detection. Attackers have been quietly learning how to beat it. Here is what adversarial ML looks like in practice and why layered detection still matters.
Most organizations have no accurate inventory of their APIs, no consistent authentication on internal endpoints, and at least one deprecated version still responding to requests. The API layer is where modern attacks increasingly land, and it remains the least consistently governed part of the stack.
Collecting SOC 2 reports from vendors is standard practice. Actually reading them is rare enough to be exceptional. The gap between the report and the risk decision it is supposed to inform is where most vendor security programs quietly fail.
Declaring an incident closed after patching the entry point is not the same as knowing the attacker is out. Most organizations conflate eradication with containment and call it done before they have answered the hardest question in incident response.
Every year, organizations spend serious money on red team engagements when what they actually need is a penetration test. The terms get used interchangeably in vendor proposals, which serves the vendor well and the buyer poorly. Here's what each one actually measures.
A developer commits a credential, notices it three days later, rotates the key, and closes the ticket. What nobody checks is whether anyone used it in between. Here is where secrets actually live and how to stop losing them.
Most organizations run post-incident reviews. Very few of them produce meaningful change. The problem is not that teams skip the meeting. It is that they mistake documenting what happened for learning from it.
In the first hour of an incident, your team is focused on what is happening technically. Nobody is thinking about legal counsel, the regulatory clock, or the customer whose data might be in the pile. That notification problem is its own fire, and it starts burning the moment you decide to handle it later.
Most organizations have an incident response plan. Most of those plans live in a document that was last opened during the audit that required it. The gap between having a plan and being able to execute one is where incidents go to become disasters.
The first hour of an incident is full of pressure to do something, and the most tempting something is to pull the plug. But containment trades away evidence, visibility, and uptime, and the responders who do it well treat it as a decision with a cost, not a reflex.
While your governance committee debates an AI usage policy, your employees have quietly adopted a dozen AI tools and fed them everything from source code to customer lists. Shadow AI is the new shadow IT, and it moves faster.
Every organization has a stack of approved security exceptions that were meant to last 30 days. Some of them are five years old. Here is how exception debt accumulates, why nobody notices, and what it costs when someone finally does.
Large language models are trained on data with a cutoff date and then deployed for months or years afterward. The gap between what the model knows and what is currently true is a security problem that most AI deployments have not accounted for.
In 2024, a finance employee in Hong Kong transferred 25 million dollars to criminals after a video call with what appeared to be his CFO. Everyone on the call was fake. Here's what AI-generated social engineering looks like now and what you can actually do about it.
After hundreds of penetration tests across dozens of industries, a pattern emerges. Different organizations, different sizes, different maturity levels. Same findings, every time. Here's the short list of things that are almost always wrong and why they stay that way.
Enabling multi-factor authentication is one of the most effective controls you can deploy. It is also not nearly enough on its own, and attackers figured that out a while ago. Here's what MFA actually stops, what it doesn't, and what comes after.
The average enterprise vulnerability scanner returns tens of thousands of findings. Treating them all equally is operationally impossible and strategically wrong. Here's how to build a prioritization model that focuses your team on the vulnerabilities that are actually going to get you.
I write phishing emails for a living. I've sent thousands of them to employees as part of authorized engagements. I know every trick in the playbook. And one got me anyway. Here's what happened and why it matters.
The most common finding in cloud security assessments isn't an exotic zero-day. It's a checkbox that defaulted to public, an IAM role that was supposed to be temporary, and a storage bucket named after an internal project sitting fully exposed to the internet.
Every year, employees click through the compliance module. Every year, people still get phished. The annual training checkbox is not a security control. Here's what actually changes human behavior in ways that hold up under real attack conditions.
Eight characters, one uppercase, one number, one symbol. Changed every 90 days. Completely useless. Here's why your password policy is training users to create worse passwords, and what to do instead.
Physical penetration testing is the part of security assessments nobody wants to think about because the findings are deeply embarrassing. A look at how alarmingly easy it is to walk past $2 million worth of security technology with a smile and a pastry.
Zero Trust has become one of the most overused terms in enterprise security. Here's what it actually means and what it takes to implement it in a way that reduces real risk.
Most Zero Trust programs stall after the first phase. The reason is almost never technical. Here's how to build a roadmap that survives contact with your organization.
Machine learning in security operations creates as many false positives as it prevents. Here's how to tune your detection models and build analyst workflows that scale.
Large language models introduce a new class of vulnerabilities that traditional security controls weren't designed to catch. Here's what security teams need to understand now.
The updated framework introduces a new Govern function and expands scope beyond critical infrastructure. A practitioner's guide to mapping your existing controls to the new structure.
A penetration test is not a vulnerability scan with a human attached. Here's what a real engagement looks like from scoping to final report and what separates useful findings from checkbox compliance.
Available for consulting engagements, speaking opportunities, and strategic security advisory roles.
Whether you need a security architecture review, a penetration test scoped for your environment, or a keynote that makes compliance genuinely interesting - reach out and let's talk.