Cybersecurity and cloud, focused on identity and detection. I build small working systems and document the decisions behind them — especially the permission boundaries most tutorials skip past.
Currently targeting IAM and SOC analyst work — based in Dallas–Fort Worth, open to relocating anywhere in the US!
Entra-ID-Identity-Lab — Joiner-mover-leaver run in a self-built Microsoft Entra ID tenant, the cloud counterpart to the AD lab above. The write-up covers what soft-delete actually revokes (the object comes back, but the entitlement was gone the whole time), standing privilege as the concrete case for PIM, and the audit-log evidence behind each phase.
Active-Directory-Identity-Lab — Two-VM Active Directory domain (Windows Server 2025 → Windows 11 client) built to run a full joiner-mover-leaver cycle. OU and security group design scoped to job function, with the mover step removing the old group rather than stacking a new one — the write-up covers privilege creep, the Security log events proving each phase (4720, 4729, 4725), and the APIPA misconfiguration I diagnosed along the way.
Splunk-Brute-Force-Detection — Brute-force detection in Splunk Enterprise. SPL search that extracts usernames and source IPs from Linux auth logs and ranks attackers by attempt volume and distinct accounts targeted. The write-up covers how I caught a duplicate-ingestion error by cross-checking Splunk against an independent Python parser.
SSH-Log-Analyzer — Python script that parses SSH authentication logs, counts failed attempts per source IP, and flags addresses crossing a threshold. The independent check that validated the Splunk work above.
Failed-Login_Parser — Serverless AWS pipeline (S3 → Lambda → DynamoDB) that parses SSH logs for brute-force attempts. Built around least-privilege IAM — the write-up includes the scoped execution policy, the resource-based policy, and the AccessDenied errors I worked through getting there.
Four years in restaurant operations, three of them in leadership, most recently fifteen months owning account provisioning and deprovisioning across four systems. That work also included physical access controls and responding to audit findings — which is where the interest in identity started.
- CompTIA Security+ — 2026
- AWS Certified Cloud Practitioner (CLF-C02) — 2026
KQL, Microsoft Sentinel and detection engineering. AWS IAM at depth.