Selected work

Each entry follows the same shape: the problem as it actually presented, what I built and what I traded away to build it, and what I would do differently now. That last section is the one I would read first — it is where the limits of the first version are, and it is a fairer test of someone’s judgment than any outcome.

• A forensics and research lab, off the corporate network

  Digital forensics, Malware analysis, OSINT, Lab infrastructure

  Why a SOC needs somewhere to work that isn't the enterprise network, what I built, and the three things I would do differently if I built it again.

This page is deliberately scoped for public reading. Operational specifics about my employer’s security program — figures, internal system names, and program detail — are omitted. If you are evaluating me for a role and want the fuller picture, email me and I will share a more detailed version.