// under construction — some content may be incomplete

// career

Experience

A career built across industries, from managed security operations to executive advisory, every role sharpened a different edge.

Staff Security Engineer: Threat Defense & Automation

Proofpoint

Cybersecurity & Email Security
November 2025 to Present
Remote
  • Command L3 escalations and global, high-severity security incidents. Orchestrate cross-functional responses across SOC, Threat Intelligence, Security Engineering, and business stakeholders and drive post-incident reviews that result in actionable improvements to detection, automation, and hardening.
  • Drive enterprise-wide threat hunting and detection improvement efforts, using MITRE ATT&CK, threat intelligence, and incident findings to identify visibility gaps, strengthen detection coverage, and improve response readiness against current and emerging adversary behavior.
  • Build the automation and AI foundation for an agentic SOC, integrating SOAR workflows, scripting, AI assisted analysis, and security telemetry pipelines to reduce false positives, accelerate triage, improve investigation quality, and move analysts faster from signal validation to containment and remediation.
  • Champion continuous improvement after major incidents by facilitating post-incident reviews, identifying control and detection gaps, improving playbooks, and mentoring analysts on investigation strategy, threat hunting, automation, and incident command practices.
MITRE ATT&CKThreat HuntingSOARAI/AutomationIncident ResponseDetection EngineeringThreat Intelligence

Principal Security Engineer / Director

FabFitFun

eCommerce
February 2022 to Present
Remote
  • Directed enterprise security strategy spanning corporate systems, data, and multi-cloud infrastructure (AWS, Azure, GCP), securing subscription eCommerce and DTC operations, partnering Technology, Legal, Compliance, and business leaders to reduce risk and mature security controls across the platform.
  • Owned the full vendor and procurement lifecycle to deploy and maintain SumoLogic SIEM for centralized log collection, correlation, and continuous security monitoring across production and corporate environments.
  • Designed and implemented an enterprise IAM strategy integrating centralized identity management, VPN, SSO, and MFA to enable secure offshore third party Customer Support/CX access.
  • Secured checkout flows, payment integrations, and customer data handling by conducting secure code reviews and threat modeling for new ecommerce features, defending against card testing, account takeover, credential stuffing, and fraudulent chargeback schemes.
  • Locked down multi-cloud workloads across AWS, Azure, and GCP by enforcing IAM least-privilege, network segmentation, and centralized secrets management spanning production and corporate environments.
  • Eliminated entire classes of code vulnerabilities by building SAST, DAST, and SCA scanning directly into the build pipeline, blocking risky dependencies and insecure code from merging without manual review.
  • Partnered with Legal, Compliance, and engineering leadership to align security initiatives with business objectives, translating risk findings into prioritized engineering work.
AWSAzureGCPSumoLogicHackerOneOneLoginCisco AMPFalcoAppArmorTrivy

Engineering Manager, Security

SpotHero

Parking & Mobility Technology
January 2020 to February 2022
Chicago, IL
  • Spearheaded the full vendor and procurement lifecycle to deploy and maintain SumoLogic SIEM and Signal Sciences (Fastly) WAF, securing customer-facing applications.
  • Integrated Auth0 to secure identity and access management for internal users, external customers, and partners, enforcing OAuth2, JWT, and token-based authentication patterns across REST and GraphQL APIs.
  • Deployed and tuned Imperva bot protection and rate limiting to detect and mitigate automated abuse, credential stuffing, account takeover, and scraping across customer-facing AWS infrastructure.
  • Embedded security into the SDLC by integrating SAST, DAST, and SCA scanning with Trivy, Checkov, and Snyk into Kubernetes-based CI/CD pipelines, automating policy checks across build and deployment workflows.
  • Secured AWS application workloads (EKS, EC2, S3, RDS) by enforcing IAM least-privilege access, network segmentation, and secrets management across staging and production environments.
  • Designed and launched a self-hosted, semi-private bug bounty program to crowdsource vulnerability discovery.
  • Managed endpoint protection and identity across SentinelOne, Okta, Jamf, and Intune to protect corporate devices and cloud workloads.
SumoLogicAuth0Signal SciencesImpervaSentinelOneOktaKubernetesAWS

Incident Response Analyst (Contract)

Athena Health

Healthcare Technology
November 2019 to January 2020
Watertown, MA, Remote
  • Investigated and responded to security incidents across the connected healthcare platform, partnering engineering teams to remediate vulnerabilities affecting patient data.
  • Conducted threat modeling and risk assessments, informing vulnerability prioritization across the product portfolio.
  • Investigated security incidents involving connected medical devices integrated with the platform, closing gaps in device to platform data flows.
Incident ResponseThreat ModelingRisk AssessmentHealthcare SecurityMedical Devices

Team Lead, Security Operations

Relativity

Legal Technology & eDiscovery
April 2018 to December 2019
Chicago, IL
  • Architected defense-in-depth controls spanning endpoint, network, identity, and data layers across corporate and Azure Cloud environments, validating telemetry from each layer into Splunk Enterprise Security for full attack surface visibility.
  • Led and mentored a team of five analysts and engineers across security operations, incident response, threat detection, and threat intelligence.
  • Directed company-wide rollout of Proofpoint email security, Splunk Enterprise Security, Aperture (Palo Alto) CASB, and Digital Guardian DLP.
  • Investigated endpoint-based incidents through to root cause, performing triage, forensic artifact collection, timeline reconstruction, and containment using EnCase, FTK, and Velociraptor.
  • Developed structured threat hunts mapped to MITRE ATT&CK techniques and supported purple-team exercises to verify control efficacy using Carbon Black EDR and Recorded Future / Anomali, converting findings into durable detections.
  • Built SOAR workflows to automate enrichment, triage, and containment, reducing threat actor dwell time.
  • Owned security policies, standards, and guidance for SOC 2, ISO 27001, and FedRAMP audits.
SplunkProofpointCarbon BlackRecorded FutureSOC 2ISO 27001FedRAMPDFIRMITRE ATT&CKSOARPurple TeamingDLP

Senior Cyber Intelligence Analyst

Cubic Corporation

Defense Contracting
August 2017 to April 2018
San Diego, CA
  • Tracked and investigated advanced persistent threats and nation-state actor activity targeting defense industrial base systems across Linux and Windows environments.
  • Employed Splunk Enterprise Security, CrowdStrike EDR, and Proofpoint for threat hunting, malware analysis, and digital forensics.
  • Profiled adversary TTPs and mapped adversary behavior to MITRE ATT&CK, producing intelligence reports that informed detection priorities and defensive posture.
  • Developed and maintained IOC feeds and detection rules to operationalize threat intelligence across Splunk and CrowdStrike, accelerating identification of adversary infrastructure and tooling.
  • Conducted malware analysis and reverse-engineering of suspicious artifacts to determine capability, attribution, and impact on cleared information systems.
  • Aligned security operations to DFARS 252.204-7012 and NIST SP 800-171 safeguarding requirements for controlled unclassified information (CUI).
  • Coordinated threat intelligence sharing and incident reporting with federal partners and defense sector stakeholders to strengthen collective defense across the supply chain.
APTCrowdStrikeSplunkProofpointThreat HuntingMalware AnalysisMITRE ATT&CKDFARSNIST 800-171CUIThreat IntelligenceDFIR

Senior Cyber Security Analyst

Cedars-Sinai Hospital

Healthcare
April 2016 to July 2017
Los Angeles, CA
  • Established the security operations buildout including processes, procedures, and team development.
  • Migrated SIEM from QRadar to Splunk Enterprise Security and conducted risk assessments across M&A and patient systems.
  • Enforced threat monitoring aligned to HIPAA and HITRUST frameworks.
SplunkQRadarHIPAAHITRUSTRisk Assessment

Information Security Operations Analyst

Citibank

Financial Services & Banking
May 2015 to March 2016
Irving, TX
  • Investigated security alerts and incidents using Splunk Enterprise and HP ArcSight SIEM.
  • Conducted forensic examination of affected systems and tuned detection rules and dashboards to improve signal fidelity.
  • Tracked DDoS activity using NetScout.
SplunkHP ArcSightDFIRDDoS

Senior SIEM Security Analyst (Contractor)

MGM Resorts International

Hospitality, Gaming & Casinos
November 2014 to May 2015
Las Vegas, NV
  • Administered McAfee Enterprise Security Manager (ESM) SIEM across hotel and casino properties.
  • Tuned correlation rules and dashboards to support high-volume operations.
McAfee ESMSIEM

IT Information Security Analyst

Aramco Services Company

Energy & Oil and Gas
January 2013 to October 2014
Houston, TX
  • Detected and triaged security alerts across a global 24/7 SOC using McAfee Nitro ESM, Cisco Email Security, and Palo Alto Firewall.
  • Coordinated incident response with counterpart SOC teams in Amsterdam and Saudi Arabia.
McAfee NitroPalo AltoSOCIncident Response

Network Security Analyst

Alert Logic

Managed Security Services
October 2010 to January 2013
Houston, TX
  • Delivered frontline analyst coverage in a 24/7 managed security operations center, triaging hundreds of network security alerts per shift across a large multi-tenant customer base.
  • Deployed sensors and issued actionable incident handling guidance to improve customer security posture.
MSSPSOCNetwork SecurityIncident Handling

Technical Support

Apple, Inc.

Consumer Technology
August 2007 to September 2010
Austin, TX
  • Diagnosed and resolved operating system, network, security, and Apple software issues on macOS and iOS, delivering AppleCare technical support for consumer and education customers.
macOSiOSAppleCareTechnical SupportNetworking