Experience
Offensive Security
I run adversarial security work against real environments — not checkbox exercises against a stripped-down lab. Every effort targets a clear objective, runs under written rules of engagement, and produces findings an engineer or an executive can actually act on.
Penetration Testing
Hands-on attack simulation across external, internal, and network layers.
- External — internet-facing assets
- Internal — assumed-breach scenarios
- Network — segmentation, lateral movement, Active Directory
- Output: findings with reproduction steps and remediation priorities
Where it fits: compliance milestones, infrastructure changes, annual baseline.
Red Team
Goal-oriented adversarial simulation — a real test of whether detection and response can stop a determined attacker pursuing a specific objective.
- Objective-driven scope
- Multi-vector approach
- Full attack-chain documentation
- Joint readout with the blue team
Purple Team
Collaborative offense-meets-defense — running attacker TTPs against an environment with the detection team in the room, tuning as we go.
- Pre-selected TTPs (MITRE ATT&CK aligned)
- Live execution with defender visibility
- Iterative detection tuning
- Detection-gap notes with query and rule recommendations
Security Engineering
Hands-on architecture, hardening, and tooling — I build the thing, I don't just hand over a deck.
- Cloud and identity hardening
- Detection engineering
- Infrastructure-as-code security
- Secrets management and zero-trust architecture
On GitHub
The infrastructure behind the work
The red-team infrastructure I use is documented and open — the manual playbook for standing it up by hand, and the Terraform that automates the whole build.
Want to talk shop?
Happy to get into the weeds on any of this — a role, a collaboration, or just the craft.
Get in touch