Cybersecurity Professional & Detection Engineer
10+ years in IT and security. Building detection infrastructure, hunting threats, and translating technical risk into business outcomes. Based in Durham, NC.
// capabilities
// threat intelligence
DMZHOST Netherlands infrastructure. 17 vendors malicious. 571 sessions/day against honeypots. Multi-purpose campaign: SSH brute force + phishing. Recommend blocking entire /24 subnet.
373 connection attempts, 370 successful logins. Single payload per session: uname -s -v -n -r -m. Pure inventory building — cataloging targets for later exploitation. Coordinated with 170.64.192.224.
Custom SSH-2.0-Go scanner targeting mysql system accounts. HASSH fingerprint 2ec37a7cc8daf20b10e1ad6221061ca5. Post-auth GPU/CPU recon consistent with cryptominer staging. Flagged by Cluster25, Criminal IP, GreyNoise.
OpenSSH Windows client targeting ubuntu/123456. Automated CPU/GPU/architecture enumeration consistent with cryptominer deployment staging. 0/93 VirusTotal but flagged Suspicious by GreyNoise.
// background
CISSP-certified security professional with over a decade in IT and cybersecurity. I build detection infrastructure, investigate real threats, and bridge the gap between technical security operations and business stakeholders.
Currently operating a home lab with a Cowrie SSH honeypot exposed to the internet, Wazuh SIEM with custom detection rules, automated threat intelligence feeds, and AWS canary credential traps — generating and analyzing real attacker data daily.
My background includes client-facing security work, vendor relationship management, and scoping infrastructure and security projects for organizations of varying technical maturity.
// get in touch
Open to SOC Analyst, Detection Engineer, and cybersecurity consulting opportunities.
Based in Durham, NC. Available for remote and hybrid roles.