I hunt adversaries for sport and build products for leverage. Both sides of the wire — detection, exploitation, intelligence. Running AI against security data before it was a buzzword. Perpetually building — tools, ventures, systems.
Most defenders have never attacked anything. Most attackers have never defended anything. I've done both — and that gap is where every missed detection, every bypassed rule, every blind spot lives.
Years of SOC work built depth in detection, log forensics, and threat intelligence. Deep study of offensive tradecraft gives context no certification teaches — how attackers actually move, what they leave behind, and what defenders almost always miss.
Proactive adversary hunting across complex enterprise environments. Behavioral detection, SIEM rule engineering, offense triage, multi-stage correlation. Know what real attacker artifacts look like in logs — not textbook theory. Built tooling that collapses detection timelines.
Full attack lifecycle knowledge — initial access, lateral movement, persistence, exfiltration. Understanding how real intrusions unfold changes every detection you write. The offense side isn't separate from defense; it's the thing that makes defense actually work.
Monitoring adversary infrastructure across clearnet and Tor. Tracking ransomware groups, leak forums, data broker activity, actor alias networks. Turning raw OSINT into structured intelligence with real operational value — not just IOC lists.
Running large language models against raw security data — logs, events, behavioral sequences. Automated interpretation, triage, and investigation summaries. Building pipelines where AI does the heavy processing so analysts can stay focused on decisions, not data wrangling.