Projects & Case Studies

2026

The site you're reading. Next.js 15 + React 19 + Tailwind portfolio grounded in a deterministic resume-intelligence pipeline, a RAG-trimmed chat assistant, and a Neon-backed question log.

Resume variants merged

36

Knowledge base

~400 KB

Pages

10

Functional proof that the same person writing security posture docs can also ship a typed, tested Next.js app with a retrieval-aware chat layer — not a static one-pager.

2026

Python build pipeline that turns 36 inconsistent resume variants into one canonical, source-traceable knowledge base — PDF/DOCX ingest → per-variant normalize → deterministic merge → embeddings → HDBSCAN clustering → verify.

Resume variants

36

Pipeline stages

7

Skills extracted

431

The chat assistant and every rendered page inherit the discipline of this pipeline — no hand-curated claims, every line traces back to evidence.

2026

Playwright-driven CLI that toggles both 2.4 GHz and 5 GHz radios on a Nokia Beacon 2 without decrypting the router's RSA+AES config protocol — drives the real web UI in headless Chromium instead.

Bands controlled

2 (2.4 GHz + 5 GHz)

Automation

Headless Chromium

Demonstrates crypto-aware protocol analysis, pragmatic trade-offs between HTTP replay and maintainable browser automation, and operational polish (retry, screenshots, docs) that extends beyond resume claims.

2025–2026

Designed and built an MSSP partner's client-onboarding portal and automation stack — workflow logic, webhook + Inngest integrations, MSI installer generation, n8n workflow development, lifecycle automation, and credential-gated provisioning.

Delivery model

Multi-client, repeatable

Pipeline

Event-driven (webhook → Inngest → provisioning)

Automation

MSI generation + lifecycle checks

Multi-client delivery that used to be bespoke per customer now runs as a repeatable event-driven pipeline — the same pattern that makes AI-assisted automations durable in production.

2026

Rescued a client SharePoint site suffering corruption and a broken folder structure — stood up a clean target, migrated content with structural cleanup, and implemented RBAC to replace ad-hoc permissions with a governed model.

Deliverables

Migration + RBAC + runbook

Clean governance beats clever workarounds when permission debt starts breaking application logic — clients remember the consultant who left them with something maintainable.

2026

Authored and executed a multi-phase professional-services SOW covering server virtualization, Azure AD / identity migration, SharePoint and DLP migration, application modernization, and remote-work optimization — owned scoping and delivery.

Phases

5

Ownership

Scoped + delivered by same person

Domains

Virtualization, identity, SharePoint, DLP, remote-work

Demonstrates that 'strategy vs hands-on' is a false dichotomy — the same engagement can carry both when the consultant owns both the contract and the keyboard.

2024–2025

Stood up and scaled a 24×7 global SOC and CSIRT of 20+ analysts supporting 60+ regulated customer environments, processing 500+ alarms per day with a governed IR framework, 120+ playbooks, and 1,500+ ATT&CK-aligned detections.

Analysts

20+

Environments

60+

Daily alarms

500+

Detections

1,500+

Demonstrates the difference between managing a SOC and building one — the framework, detections, playbooks, and metrics that make operations durable beyond any single analyst.

2024–2025

Authored 7 major ServiceNow epics comprising 80+ enhancement stories and delivered 150+ dashboards and widgets — replacing subjective reporting with evidence-based KPI/SLA visibility for SOC and CSIRT operations.

Epics

7

Stories

80+

Dashboards

150+

You can't improve what you can't measure — this program replaced gut-feel reporting with evidence-based visibility that survived leadership changes and org restructuring.

2024–2025

Built and operationalized agentic and automated investigation pipelines using AI/SOAR automations and custom ServiceNow workflows, increasing analyst throughput by 35%+ and reducing burnout in a high-volume 24×7 SOC.

Throughput gain

35%+

Duplicates/day

150–200

AI in security operations is only useful if analysts trust it — this project paired automation with governance so the throughput gains were durable, not just demo-worthy.

2019–2024

Upgraded over 1,200 customer-facing servers to the latest code in a 4-week project with less than 0.00001% downtime per server — a fleet-wide rollout across a global customer base.

Servers

1,200+

Duration

4 weeks

Downtime

<0.00001%

Fleet-scale operations require planning discipline that small-environment work doesn't — this was 1,200 individual change windows executed without breaking customer trust.

2019–2024

Directed the ISO 27001 certification program across HR, IT, Product, Engineering, and Compliance — risk assessments, evidence creation, control validation, and audit readiness aligned to NIST, GDPR, HIPAA, and SOC 2.

Departments

5

Frameworks

5

Compliance programs that span the whole org require translation between business functions — this wasn't a checkbox exercise, it was organizational change management with audit evidence.

2019–2024

Operated and migrated a global SharePoint environment spanning four continents through two corporate identity changes — ContentKeeper → Impero → Ativion — preserving content, permissions, and compliance posture.

Continents

4

Rebrands

2

Most migration projects happen once. Doing it twice under acquisition pressure — while keeping the lights on globally — tests governance discipline more than any single-shot effort.

2019–2024

Designed and configured a server-side Continuous Diagnostics and Mitigation (CDM) script to detect DDoS attacks on customer appliances, ensuring remote filtering stayed accessible and CIPA compliance was maintained.

Environments

1,000+

Compliance

CIPA

When compliance depends on uptime, detection isn't optional — this closed the gap between 'filtering is deployed' and 'filtering is actually working right now.'

2019–2024

Designed a multi-language script suite (Bash, C++, Perl, Python) to test and verify web SSL certificates on customer servers, ensuring HTTPS/SSL tunnels were not compromised across the global fleet.

Server fleet

1,200+

Languages

4

Decryption products that can't verify their own certificates are a liability — this tooling caught issues before customers or auditors did.

2018–2019

Replaced 1,500 Cisco AP/ISE components with 600 Ruckus/Cloudpath units across 32 locations in 3 months — reducing wireless support tickets by 90% and refresh costs by 70%.

Locations

32

APs replaced

1,500

Ticket reduction

90%

Cost savings

70%

Ops leadership

~50 across 4 depts

The best infrastructure projects aren't the ones that add — they're the ones that simplify. 1,500 components became 600 and the tickets dropped 90%.

2018–2019

Revamped the district's web-filtering architecture with AD, NAC, and SIEM integration. Within 3 months, real-time alerting identified 3 individuals in crisis and enabled intervention within the hour.

Students

15,000

Employees

2,500

Lives impacted

3

Technology projects rarely have life-or-death outcomes. This one did — three times in three months. The integration that made it possible was an architecture decision, not a product feature.

2018–2019

Took initiative to conduct a 15-category technology analysis of the school district, resulting in a $1.9 million budget amendment to implement all recommendations.

Categories

15

Budget secured

$1.9M

Technical leaders who can translate risk into budget language unlock resources that pure technicians never see. This wasn't assigned — it was identified, built, and defended.

2018–2019

Upgraded IOS from ipbase to ipbasek9 across 700 Cisco switches in 3 weeks with zero errors, migrating remote access from Telnet to SSH district-wide.

Switches

700

Duration

3 weeks

Campuses

32

Errors

0

Telnet on management interfaces is a textbook finding in every pen test — fixing it across 700 switches in 3 weeks with zero errors is the execution that makes hardening real.

2018–2019

Engineered the network backbone for a relocated Network Operations Center — implemented failover connections for 6 server hosts while upgrading from 1Gbps to 10Gbps, and relocated WLAN controllers and 500+ SVIs off the overloaded core.

Server hosts

6

SVIs relocated

500+

Speed upgrade

1G → 10G

A NOC move is a forcing function to fix everything you tolerated — this one retired an overloaded core and 10x'd host connectivity in the same window.

2018–2019

Implemented SSL decryption and built 70+ UEBA and behavioral-risk profiles — some reaching 10,000 configuration lines — to detect insider threats, policy violations, self-harm indicators, compromised accounts, and advanced threat patterns.

Profiles

70+

Accounts

20,000+

Max config lines

10,000+

UEBA at this depth in a K-12 environment — where the threat model includes self-harm, not just data exfil — requires a different kind of care than corporate deployments.

2018–2019

Authored the district's Disaster Recovery Plan (DRP) and Critical Infrastructure Protection (CIP) documentation, aligning technical controls with resilience and continuity objectives across 32 campuses.

Campuses

32

Staff coordinated

~50

Departments

4

Aligned to

NIST CSF + SB 820

A DRP that sits in a drawer isn't a plan — this one was built to be used by non-technical stakeholders, not just filed for compliance.

2017–2019

Multi-year participant and team lead at Cyber Shield 2017–2019: 150+ forensic investigations, red team isolation, Top 7 national ranking. Developed training programs adopted across multiple states.

Exercises

3 years

Investigations

150+

National rank

Top 7

Exercises reveal what SOPs and certifications can't — how you perform under pressure, with incomplete information, against a live adversary.

2017

During Hurricane Harvey, re-engineered the Joint Forces Headquarters (TX ARNG) personnel reporting system from a 2-hour-per-day manual process to an instantaneous formula-driven workflow.

Time saved

2 hrs/day

Context

Hurricane Harvey

Reporting speed

2 hrs → instant

The best automation happens when the pain is highest — reclaiming 2 hours per day during a natural disaster response isn't optimization, it's operational necessity.

2015–2018

Split 1 overloaded Windows Server 2012 R2 into 4 campus-segmented servers running Google Cloud Print for 150+ printers and 2,200 users — reducing printer help desk tickets by 75% in 2 weeks.

Printers

150+

Users

2,200

Ticket reduction

75%

Duration

2 weeks

Sometimes the fix isn't a new product — it's recognizing that one server doing everything is the problem, and segmentation is the answer.

2015–2018

Led migration from an on-premises PlascoTrac SQL database to the HeroK12 cloud solution, increasing service availability from 50% to 99%.

Availability before

~50%

Availability after

99%

Availability gain

~2×

A visitor management system at 50% availability is a campus security gap, not just an IT inconvenience — this migration closed it.

2006–2015

Designed and configured 100+ LAN networks for gaming tournaments and competitive events — high-density, low-latency connectivity under tight timelines.

Events

100+

High-density networking under time pressure with zero tolerance for latency — the same fundamentals that matter in enterprise, learned in a context where the users notice every dropped packet.

2006–2015

Built and ran an independent consulting practice serving 40+ small businesses, nonprofits, and churches — delivering vulnerability assessments, pen testing, infrastructure hardening, and high-availability design targeting 99.999% uptime.

Clients

40+

Personnel

3

Uptime target

99.999%

Running your own practice from age 18 teaches business fundamentals that employment never does — scoping, pricing, delivery, and the consequences of getting any of them wrong.

2024–2025

Led enterprise vulnerability and exposure response across on-prem, AWS, Azure, and hybrid environments using Wiz, SafeBreach, and Gem Security — driving zero-day triage, cloud detection maturity, and defensible outcomes for regulated financial-services and payment-processing customers.

Environments

60+

Architecture

Multi-cloud + hybrid

Vulnerability management at MSSP scale requires more than scanning — it requires governance, SLA discipline, and the ability to tell a board-ready story about residual risk under time pressure.

2019–2024

Built and tuned detections and investigative workflows across 10+ platforms (CyberArk, Okta, AD, M365, Palo Alto, Fortinet, Cisco Firepower, ManagedMethods) covering identity, endpoint, network, web, and cloud telemetry for 1,000+ customer environments.

Platforms

10+

Environments

1,000+

Detection engineering across 10 platforms and 1,000 environments isn't copy-paste — each customer's telemetry, baseline, and risk profile requires tuning that generic rules can't provide.

2019–2024

Built and matured strategic threat intelligence and malware analysis capabilities — identifying cybercrime TTPs, integrating adversary behavior into operational defense, and serving as an external-facing security voice at coalitions, conferences, and podcasts.

Customer environments

1,000+

External presence

Conferences, podcasts, coalitions

Coverage

TI → detections → product security

Threat intelligence that never leaves the analyst's desk doesn't improve organizational defense — this program connected TI to detections, product security, and external collaboration.

2019–2024

Applied adversary TTPs and threat hunting techniques during product hardening — testing trust boundaries, identity flows, web application logic, endpoint weaknesses, and multi-tenant exposure paths before release.

Attack surface

Trust boundaries, identity flows, web app logic

Architecture

Multi-tenant

Integration

Embedded in dev lifecycle

Product security that happens at release is too late — this embedded adversary thinking into the development lifecycle where fixes are cheap and customers aren't exposed.

2018–2019

Designed and implemented Palo Alto GlobalProtect VPN with least-privilege configuration for all staff and students, plus a dual-VPN setup with ContentKeeper Mobile Agent — both working seamlessly together.

Users

17,500+

Dual-VPN configurations that 'just work' require deep understanding of both products' tunnel behavior — most implementations break one to fix the other.

2018

In the first week on the job, conducted a wireless audit that led to reconfiguration of 1,200+ access points — materially reducing wireless issues at remote sites and eliminating ~20% of core switch load by relocating WLAN controllers and 500+ SVIs.

APs reconfigured

1,200+

SVIs relocated

500+

Load reduction

~20%

Identifying and fixing systemic architecture issues in week one — before even finishing onboarding — demonstrates the kind of judgment that doesn't require a long ramp-up.

2018–2019

Brought on and partnered with an MSSP for monitoring and response, then used internal architecture knowledge to shape hunts, tune use cases, and improve detection coverage for the district.

Campuses covered

32

Students

15,000

MSSP partnerships that work require an internal champion who can translate architecture into detection priorities — without that bridge, the MSSP is flying blind.

2018–2019

Conducted a vulnerability assessment that discovered a BIOS-level weakness allowing users to grant themselves local admin privileges — remediated across the fleet via BIOS configuration change.

OS-level controls mean nothing if the BIOS lets users bypass them — this finding required thinking below the operating system, not just scanning it.

2017–2021

Executed SharePoint migrations between TX ARNG and big-Army environments during the Army's on-prem-to-cloud consolidation — applied DLP controls to prevent data spillage across classification boundaries.

Organizations

TX ARNG + big-Army

Boundary type

Classification boundaries

Migration context

Army on-prem → cloud consolidation

Data spillage across classification boundaries in a military context isn't a policy violation — it's a security incident. DLP during migration isn't optional, it's the constraint the whole project is built around.

2017–2021

Performed defensive cyber operations, DFIR, malware analysis, and threat hunting in mission-focused environments supporting 100,000+ account ecosystems and organizations worth hundreds of millions.

Accounts

100,000+

Defending military-scale ecosystems against nation-state adversaries builds judgment that commercial environments rarely test — the stakes and adversary sophistication are different.

2015–2018

Managed the annual roll-in/roll-out of 2,200 Chromebooks — restoring, repairing, and returning every device with zero inventory loss year over year.

Devices

2,200

Projectors

200

Printers

150+

Inventory loss

0

Zero loss across 2,200 devices annually sounds simple until you try it with students, multiple campuses, and a summer window — it requires process discipline, not just labor.

2015–2018

Changed the district's help desk ticketing system to Eduphoria, improving response time, documentation integrity, and accountability by making ticket status visible to the entire organization.

Transparency is the cheapest way to improve IT accountability — when users can see their ticket status, the team naturally responds faster.

2006–2015

Repaired, rebuilt, and modified devices and robotic equipment for competitions and community outreach initiatives.

Technical skills applied to community outreach demonstrate that the work isn't just a job — it's a calling that extends beyond billable hours.

2006–2015

Consulted and delivered large-scale hardware and software upgrades for multiple churches and nonprofits — including IT systems, professional audio, and lighting platforms.

Organizations

Multiple

Systems

IT + A/V + Lighting

Technology for nonprofits has to survive volunteer turnover — designing for maintainability by non-experts is a different discipline than designing for a technical team.

2025–2026

Led technical onboarding for a high-profile enterprise client — configured identity threat detection and response (ITDR), supported EDR deployment and macOS profile handling, and defined escalation paths.

The first 30 days of a security engagement set the tone for everything that follows — clean onboarding with defined escalation paths prevents the 'who do I call' problem during real incidents.

2025–2026

Supported strategic security delivery for an enterprise client — MFA validation, EDR telemetry reconciliation against prior assessments, vulnerability remediation follow-up, and firewall/endpoint posture review.

Assessments that produce reports but never close the loop are theater — this engagement verified whether prior recommendations actually made it into production.