About

Background

A decade of investigative work, now applied to detection at enterprise scale.

My technical foundation came from the Marine Corps. I installed, repaired, and maintained ground transmission systems, vehicle intercom and electronics, digital fires situational-awareness platforms, and electronic jamming equipment — and led roughly forty Marines while doing it. I finished first among eighteen students in advanced technical training. Six years of that service ran alongside the start of my investigative career.

From there I moved into cyber investigations. I spent eight years working cybercrime cases and conducting digital forensic examinations: intrusions, unauthorized access, evidence recovery, and analysis of attacker methodology. That work was done to an evidentiary standard, which shapes how I approach every examination since — findings are only as good as your ability to prove how you reached them.

During that period I also trained in physical forensic disciplines: shooting reconstruction, bloodstain pattern analysis, and fingerprint identification and examination. It's an unusual pairing with digital work, but the underlying method is the same. You reconstruct what happened from what the event left behind.

From 2024 to 2026 I worked as a forensic analyst, handling evidence examination, intrusion investigation, and incident response for clients across a range of sectors.

Today I manage threat detection and response for a global organization. The work shifts from investigating individual cases to building the capability that catches them at scale — but detection is only as good as your ability to prove what actually happened, so the forensic discipline still underpins all of it.

The subjects I work in and speak about most often are insider risk, data loss prevention, malware analysis and reverse engineering, and business email compromise detection.