Cybersecurity Professional CISSP Penetration Tester
Started in IT. Figured out the security problems were more interesting. Haven't looked back since.
IT background. Security focus. Genuinely curious about how things break.
I came up through IT and networking. Somewhere along the way I realized the more interesting question wasn't how to keep systems running. It was how someone would get in if they wanted to.
That shift led me to security full time, backed by a Master's from Trine University and a Bachelor's in Cyber Defense from Davenport University. I work across security architecture, penetration testing, and GRC, helping organizations understand their real exposure and not just their audit score.
Trine University
Information Security & Technology Management
Davenport University
Cyber Defense & Security Operations
The best time to find a vulnerability is before someone else does. I lean into threat modeling and red-team thinking so organizations stop playing catch-up with adversaries.
NIST and ISO 27001 aren't just there to make your auditor happy. They're blueprints for actually reducing risk. I help turn compliance requirements into controls that hold up in the real world.
You can have perfect tooling and still get phished by a fake invoice. Security culture is the layer that makes everything else work, starting with making sure every person in the org knows their role.
Deep technical knowledge paired with strategic thinking across the full security lifecycle.
Designing layered, defense-in-depth security architectures that align with business objectives and scale with organizational growth.
Conducting authorized offensive security assessments to identify vulnerabilities before malicious actors can exploit them.
Translating complex regulatory frameworks into actionable security programs that satisfy auditors and reduce real-world risk.
Applying machine learning techniques to threat detection, anomaly detection, and security automation while securing AI systems themselves.
Collecting, analyzing, and operationalizing threat intelligence to inform defensive posture and proactive countermeasures.
Leading coordinated responses to security incidents - from initial detection through containment, eradication, and post-incident review.
Validated expertise across security domains, governance, and offensive security practices.
CISSP
Certified Information Systems Security Professional
(ISC)²
CC
Certified in Cybersecurity
(ISC)²
Security+
CompTIA Security+
CompTIA
PenTest+
CompTIA PenTest+
CompTIA
CNVP
Certified Network Vulnerability Professional
CompTIA
CPT
Certified Penetration Tester
GAQM
IBM
IBM Cybersecurity Certification
IBM
Proofpoint
Proofpoint Security Certification
Proofpoint
XM Cyber
XM Cyber Attack Path Management
XM Cyber
9 active certifications across 5 issuing bodies
Practical tools built to demonstrate applied security concepts - not demos, actual things you can use.
Practical perspectives on security architecture, emerging threats, and building resilient programs.
Most penetration tests start at the perimeter and try to get in. Assumed breach engagements start with a foothold already established and ask the harder question: what happens next? For organizations that have invested in perimeter controls, this is the test that actually matters.
Cloud teams assign roles. Security reviews the role definitions. Nobody checks what the combined effect of those roles, policies, and permission boundaries actually allows. The gap between intended access and effective access is where cloud breaches live.
NIST's 2024 update added a sixth function to the Cybersecurity Framework. Govern is not about security operations - it is about the organizational machinery that makes security decisions legitimate. Most security programs have not caught up with what this requires.
Machine learning teams build elaborate training pipelines and treat them like scratch work. The same code runs in privileged environments with access to production data, and nobody has reviewed it for security since the first notebook was opened.
Your web application had a penetration test. Your API did not. The attack surface is different, the vulnerabilities are different, and the tools that find them are different. Here is what a real API assessment actually looks for.
Most organizations either reflexively call law enforcement or reflexively avoid it. Neither is a strategy. The decision of whether and when to involve federal agencies carries real consequences either way, and the organizations that handle it well made the call deliberately.
A compromised endpoint on a flat network can reach your domain controllers, your backup infrastructure, and your production databases without bypassing a single additional control. Lateral movement is easy when every system can talk to every other system.
Spear phishing used to require skilled operators and manual OSINT research. LLMs removed both constraints. The personalized, convincing attacks that once targeted only executives are now economically viable at scale against anyone.
The Cybersecurity Maturity Model Certification rule is in force and DoD contracts are starting to include the clause that requires it. Companies that assumed they could self-attest their way through are discovering the gap between what they submitted and what they can demonstrate.
Active Directory Certificate Services misconfigurations have become one of the most reliable paths to domain compromise in Windows environments. Most internal penetration tests still don't look for them.
Most PAM programs report high enrollment numbers and leave the most dangerous accounts unprotected. The coverage percentage is real. The denominator it came from is not.
When investigators arrive after a breach, the first thing they look for is logs. The second thing they discover is that the logs do not go back far enough. This is not bad luck. It is a configuration choice nobody remembered making.
Most enterprise AI assistants are built on Retrieval-Augmented Generation. Most RAG deployments don't carry source document access controls into the vector database. That gap is turning your AI assistant into a confidentiality problem.
The SEC's cybersecurity disclosure rule requires public companies to file a Form 8-K within four business days of determining an incident is material. Most IR programs were not built to make that determination on that timeline.
Most organizations think they have addressed WiFi security by setting a password. A properly scoped wireless assessment finds things the internal team did not know were there.
The Digital Operational Resilience Act has been in force since January 2025. If you provide ICT services to EU financial entities, your contracts are probably affected whether you knew it or not.
Responding to a suspected insider follows a different set of rules than external compromise response. The notification list, the evidence preservation strategy, and the access removal sequence all change when the adversary is your employee.
Most organizations with a compliance framework have a risk register. Very few have a risk management program. The gap between the two is where actual exposure accumulates.
Your directory has service accounts with names nobody recognizes and passwords that have never rotated. One of them probably has Domain Admin. Nobody knows who owns them.
Your team is pulling models from public repositories and loading them directly into production infrastructure. The security review process that governs npm packages and container images has not caught up.
A mobile application pentest is not a web assessment conducted from a phone. The interesting findings come from the binary, the device storage layer, and OS interfaces that have no web equivalent.
The third-party breach notification arrives and suddenly you are managing an incident in someone else's environment, with none of the visibility and all of the liability. Most incident response playbooks were not written for this scenario.
Every organization with a cloud environment has an emergency access account that bypasses MFA and sits outside normal privilege controls. Most of them have credentials set by someone who left years ago, and nobody has verified the account since.
LLM coding assistants are writing code that gets committed, reviewed, and deployed. The vulnerabilities they introduce are real, the hallucinated dependencies they invent are getting registered by attackers, and most security review workflows treat AI-generated code exactly like everything else.
Industrial control systems run refineries, water treatment plants, and power substations. Testing their security requires a methodology that looks nothing like a standard network assessment, and applying the wrong one can take down a production line.
Most companies send security questionnaires to vendors as a form of due diligence. What they get back is a compliance artifact, not an assessment of risk. Here is what the questionnaire is actually measuring and what to do instead.
Most organizations treat a SIEM license as a detection program. It is not. Detection engineering is the discipline of writing, testing, and maintaining detection logic tuned to your environment, and vendor-supplied rules are not a substitute for it.
Turning your company's sensitive data into vector embeddings does not make it safe. Embeddings are more reversible than most practitioners assume, and vector stores are typically missing the access controls your relational databases take for granted.
Most web application penetration tests are commissioned with the right intention and structured in a way that makes them significantly less useful than they could be. Scoping is where value gets lost, before the tester ever opens a browser.
Security operations teams that rely entirely on alerts are making a bet that their detection coverage is complete. It is not. Threat hunting is what you do when you assume the attacker is already there and set out to prove it, before the alert fires.
PCI DSS 4.0 became mandatory in March 2024 and it is not a cosmetic update. MFA requirements expanded significantly, targeted risk analyses became required work, and organizations that treated the transition as a documentation exercise are finding out what they missed during their first formal assessment.
Kubernetes ships with defaults that prioritize getting things running over keeping them secure. Most clusters in production are running on those defaults. Here is what that actually looks like from an attacker's perspective and what a reasonable baseline requires.
Cloud environments violate most of what traditional incident response assumes. There is no disk to image, no cable to pull, and the evidence that exists is ephemeral. Here is what IR actually looks like when the incident is in AWS.
Organizations are rushing to fine-tune AI assistants on internal documents, support tickets, and HR data. The model does not just learn from that data - it memorizes parts of it. Training data extraction is a documented attack technique, and most internal AI deployments have not accounted for it.
M&A due diligence covers financials, legal, and operations with rigor. Security usually gets a questionnaire. The acquiring company finds out what was actually on the target's infrastructure after the deal closes, which is the worst possible time to find out.
Purple teaming is what happens when you stop treating offensive and defensive security as separate departments running separate exercises. It is the fastest way to find out whether your detection coverage actually works before a real attacker demonstrates that it does not.
Expired TLS certificates cause production outages that have nothing to do with attackers. Most organizations manage thousands of certificates with spreadsheets and panic. Here is what certificate management looks like when it works and why it almost never does.
Business email compromise does not look like a security incident until the wire is already gone. The response runs on a different clock than every other incident type, and the urgent action in the first two hours is financial, not technical.
Most AI security thinking was built around chatbots that generate text. Agentic AI systems can query databases, send emails, execute code, and spawn sub-agents. The attack surface is different, the failure modes are different, and the security frameworks most teams are applying are not adequate.
Most organizations buy cloud penetration tests and get network assessments with cloud-flavored findings. The attack surface in AWS, Azure, and GCP is API-driven and IAM-centric, and the methodology that actually finds the dangerous paths looks nothing like a port scan.
Most organizations treat cyber insurance as a financial backstop for incidents their security program failed to prevent. Insurers increasingly see it differently. The gap between those two perspectives is where claims get denied.
Ransomware response is not one decision. It is a sequence of decisions that interact, each made under time pressure with incomplete information. Most organizations have not thought through any of them before needing to make all of them at once.
Modern attackers bypass hardened production environments by targeting what generates them - the build pipeline, package dependencies, and CI/CD tooling. Most engineering organizations are running completely blind to this attack surface.
The most common path to domain administrator in an internal network assessment is not a zero-day exploit. It is a series of configuration gaps that exist in almost every Active Directory environment. Here is how that path works and what it looks like from the other side.
Machine learning has become the backbone of modern security detection. Attackers have been quietly learning how to beat it. Here is what adversarial ML looks like in practice and why layered detection still matters.
Most organizations have no accurate inventory of their APIs, no consistent authentication on internal endpoints, and at least one deprecated version still responding to requests. The API layer is where modern attacks increasingly land, and it remains the least consistently governed part of the stack.
Collecting SOC 2 reports from vendors is standard practice. Actually reading them is rare enough to be exceptional. The gap between the report and the risk decision it is supposed to inform is where most vendor security programs quietly fail.
Declaring an incident closed after patching the entry point is not the same as knowing the attacker is out. Most organizations conflate eradication with containment and call it done before they have answered the hardest question in incident response.
Every year, organizations spend serious money on red team engagements when what they actually need is a penetration test. The terms get used interchangeably in vendor proposals, which serves the vendor well and the buyer poorly. Here's what each one actually measures.
A developer commits a credential, notices it three days later, rotates the key, and closes the ticket. What nobody checks is whether anyone used it in between. Here is where secrets actually live and how to stop losing them.
Most organizations run post-incident reviews. Very few of them produce meaningful change. The problem is not that teams skip the meeting. It is that they mistake documenting what happened for learning from it.
In the first hour of an incident, your team is focused on what is happening technically. Nobody is thinking about legal counsel, the regulatory clock, or the customer whose data might be in the pile. That notification problem is its own fire, and it starts burning the moment you decide to handle it later.
Most organizations have an incident response plan. Most of those plans live in a document that was last opened during the audit that required it. The gap between having a plan and being able to execute one is where incidents go to become disasters.
The first hour of an incident is full of pressure to do something, and the most tempting something is to pull the plug. But containment trades away evidence, visibility, and uptime, and the responders who do it well treat it as a decision with a cost, not a reflex.
While your governance committee debates an AI usage policy, your employees have quietly adopted a dozen AI tools and fed them everything from source code to customer lists. Shadow AI is the new shadow IT, and it moves faster.
Every organization has a stack of approved security exceptions that were meant to last 30 days. Some of them are five years old. Here is how exception debt accumulates, why nobody notices, and what it costs when someone finally does.
Large language models are trained on data with a cutoff date and then deployed for months or years afterward. The gap between what the model knows and what is currently true is a security problem that most AI deployments have not accounted for.
In 2024, a finance employee in Hong Kong transferred 25 million dollars to criminals after a video call with what appeared to be his CFO. Everyone on the call was fake. Here's what AI-generated social engineering looks like now and what you can actually do about it.
After hundreds of penetration tests across dozens of industries, a pattern emerges. Different organizations, different sizes, different maturity levels. Same findings, every time. Here's the short list of things that are almost always wrong and why they stay that way.
Enabling multi-factor authentication is one of the most effective controls you can deploy. It is also not nearly enough on its own, and attackers figured that out a while ago. Here's what MFA actually stops, what it doesn't, and what comes after.
The average enterprise vulnerability scanner returns tens of thousands of findings. Treating them all equally is operationally impossible and strategically wrong. Here's how to build a prioritization model that focuses your team on the vulnerabilities that are actually going to get you.
I write phishing emails for a living. I've sent thousands of them to employees as part of authorized engagements. I know every trick in the playbook. And one got me anyway. Here's what happened and why it matters.
The most common finding in cloud security assessments isn't an exotic zero-day. It's a checkbox that defaulted to public, an IAM role that was supposed to be temporary, and a storage bucket named after an internal project sitting fully exposed to the internet.
Every year, employees click through the compliance module. Every year, people still get phished. The annual training checkbox is not a security control. Here's what actually changes human behavior in ways that hold up under real attack conditions.
Eight characters, one uppercase, one number, one symbol. Changed every 90 days. Completely useless. Here's why your password policy is training users to create worse passwords, and what to do instead.
Physical penetration testing is the part of security assessments nobody wants to think about because the findings are deeply embarrassing. A look at how alarmingly easy it is to walk past $2 million worth of security technology with a smile and a pastry.
Zero Trust has become one of the most overused terms in enterprise security. Here's what it actually means and what it takes to implement it in a way that reduces real risk.
Most Zero Trust programs stall after the first phase. The reason is almost never technical. Here's how to build a roadmap that survives contact with your organization.
Machine learning in security operations creates as many false positives as it prevents. Here's how to tune your detection models and build analyst workflows that scale.
Large language models introduce a new class of vulnerabilities that traditional security controls weren't designed to catch. Here's what security teams need to understand now.
The updated framework introduces a new Govern function and expands scope beyond critical infrastructure. A practitioner's guide to mapping your existing controls to the new structure.
A penetration test is not a vulnerability scan with a human attached. Here's what a real engagement looks like from scoping to final report and what separates useful findings from checkbox compliance.
Available for consulting engagements, speaking opportunities, and strategic security advisory roles.
Whether you need a security architecture review, a penetration test scoped for your environment, or a keynote that makes compliance genuinely interesting - reach out and let's talk.