Cloud SOC Detection Lab
BuiltA cloud-hosted Elastic SOC I built to practice the full detection-to-investigation workflow against live attack telemetry.
- RDP attempts
- 4,558
- source IPs
- 176
- failed SSH logins
- 47,212
- indicators published
- 258
01 // Education & certificates
Credentials
- CompTIA Security+SY0-701
- CompTIA CySA+CS0-003
- CompTIA CSAP
B.A. Liberal Arts & Sciences, New Saint Andrews College, ID · Two years completed
Certificates and details →02 // Track record
Experience
- Sep 2026 – present
Incident Response Volunteer / WA CIRT, Washington Military Department
Tacoma, WA · Hybrid
On Washington's state cyber incident response team, in the responder pool called to detect, contain, and recover from incidents.
- Jun 2025 – Mar 2026
AI Technician / AIM Intelligent Machines
Redmond / Monroe, WA
Watched a live alert feed for prototype autonomous machines and decided which alarms needed an engineer.
- Dec 2024 – May 2025
IT Support (contract) / Pirean Gallery
Moscow, ID
On site support across Windows and macOS; traced a live event outage to miswired switch ports.
- Summer 2024
Commercial Fisherman (greenhorn deckhand) / Silver Bay Seafoods
Dillingham, AK
Nineteen hour shifts, seven days a week, through peak salmon season.
- Feb – Apr 2024
Data Annotation Intern / Vantage International
Moscow, ID
Labeled transcript and image datasets used to train large language models.
03 // Selected Work · Projects
Stuff I made
SOC / Detection
BuiltGRC / Compliance
BuiltGRC Fleet Auditor
A Python tool that discovers hosts on an authorized network, audits the reachable Ubuntu hosts against the CIS Benchmark with OpenSCAP, and produces a fleet compliance report with run-over-run drift. Built as audit evidence for a GRC analyst.
Also: a segmented home network, with IoT and guest devices on their own VLANs (UniFi).
All projects →04 // Engineering with AI
Engineering with AI
I build with Claude Code as a pair: it drafts, I direct and review, and nothing ships that I can't explain. These are the tools I've built on top of that loop; the full method and toolkit live in the repo.
The full method →05 // About
About
An aspiring Cybersecurity professional with a hankering for all things technical. He enjoys doing Hack The Box blue team and red team labs, configuring detection statistics into maps, getting flag.txt, making random things and solving puzzles.
06 // Say hello