// 01 / Resume

Resume.

Purple teamer. I attack systems to learn how they break, then build the detections and fixes that catch the next attempt — across SOC, incident response, cloud and secure development.

  • Purple teaming
  • Detection engineering
  • Cloud security
  • Secure development
~ — zsh

hybridsquirrel@sec ~ $ whoami

Red by curiosity, blue by necessity. I think like an attacker, then clean up like a defender — detection rules, incident response, clouds that stay hardened. Project manager when cornered, storyteller by default. Happiest when an alert fires on the real thing, not on Friday-afternoon noise.

  • Detection engineering
  • Threat hunting
  • Incident response
  • Log analysis
  • Digital forensics
  • Cloud security
  • Security architecture
  • Zero Trust
  • Identity & access
  • Vulnerability management
  • Infrastructure as code
  • Automation
  • Secure development
  • Applied cryptography
// Track record

The numbers, without the spin.

Years in security roles
4+
Endpoints under SOC watch
2,000
Users in a monitored estate
15k
Compliance frameworks mapped
6+
// Experience

Where I've been.

  1. Aug 2023 – Nov 2025

    Security consultant

    Cybersecurity consultancy

    Embedded in client teams to turn business and technical requirements into secure, working solutions. Internally: training and lectures, scoping, proposal writing and recruitment support.

    1. Mar 2025 – Nov 2025

      Security engineer

      Government agency
      • Wrote a large set of detection rules from scratch — generic and environment-specific — deployed for several critical government agencies.
      • Normalised and validated log data and tuned rules to cut false positives, so the SOC sees real threats.
      • Validated detections alongside penetration testers during simulated attacks.
      • Basic malware analysis through source review; supported IT-incident investigations together with police and regulators.
      • Detection engineering
      • Log analysis
      • Digital forensics
      • Threat intelligence
    2. May 2024 – Nov 2024

      Security engineer

      Investment firm
      • Migrated analytical queries between SIEM platforms and retuned detections to reduce noise.
      • Built detections for privilege escalation, unmanaged devices and unusual authentication methods.
      • Automated EDR break/fix, CVE alerting, update retrieval and security reporting; designed incident response playbooks.
      • Detection engineering
      • SIEM migration
      • Infrastructure as code
      • Automation
    3. Feb 2024 – Aug 2024

      Cloud architect & engineer

      Fintech company
      • Built a cloud landing zone from scratch: SSO with RBAC/ABAC and PAM, CIS-aligned scanning and hardening, networking, encrypted multi-cloud backups and policy-based account governance.
      • Delivered a production-ready Kubernetes platform with managed secrets, DNS, load balancing, monitoring and GitOps deployments.
      • Least privilege and separation of duties throughout, toward a Zero Trust design — fully automated with infrastructure as code, configuration management and CI/CD.
      • Cloud security
      • Identity & access
      • Infrastructure as code
      • Zero Trust
    4. Oct 2023 – Jan 2024

      Security specialist — SIEM

      Investment firm
      • Led a SIEM development project covering all IT and OT systems.
      • Reworked alerting around MITRE frameworks to cut alert fatigue, and rebuilt the SOC playbooks to match.
      • Onboarded new data sources with enrichment and correlated high-severity alerts, then moved the SIEM to infrastructure as code.
      • SIEM
      • Alert tuning
      • OT security
      • Infrastructure as code
    5. Sep 2023 – Nov 2023

      Security reviewer

      Internal
      • Reviewed the security of an integration model and its tooling; interviewed technical leads and presented recommendations.
    6. Sep 2023 – Oct 2023

      Project manager & developer

      Internal
      • Ran a security-themed wellness challenge for 300+ participants and built its web app — stats, maps and encryption puzzles.
      • Project management
      • Web development
  2. Oct 2022 – Aug 2023

    IT security specialist

    Insurance organisation

    Key member of a newly founded security department. SOC covering ~800 Linux servers, ~800 Windows servers and ~400 clients, including OT.

    • Owned threat hunting and incident response, using digital forensics to collect and analyse evidence.
    • Wrote the policies and procedures for handling and preventing incidents; security advisor to data protection, procurement and other departments.
    1. Jan 2023 – Apr 2023

      Project manager — external SOC

      Insurance organisation
      • Launched an external SOC: validated log-forwarding agents, rolled out EDR to every server and client, built SIEM dashboards and integrated it with the internal SOC.
      • SOC operations
      • Endpoint protection
      • Security monitoring
    2. Apr 2023 – Aug 2023

      Project manager — scanning & pentest automation

      Insurance organisation
      • Automated vulnerability scanning against CIS Critical Security Controls and automated the provisioning of penetration testing tooling.
      • Ran penetration tests and worked with external red teamers to verify the design held up.
      • Vulnerability management
      • Automation
      • Penetration testing
    3. Jan 2023

      Advisor — CCTV/IoT network upgrade

      Insurance organisation
      • Advised on migrating a legacy CCTV/IoT network to new, standards-compliant infrastructure.
// Skills

The toolbox.

Security

  • SIEM
  • SOC
  • Threat hunting
  • Incident response
  • Forensics
  • Malware analysis
  • Log analysis & normalisation
  • Vulnerability management
  • Security architecture
  • Zero Trust
  • IAM / PAM
  • RBAC / ABAC
  • SSO / SAML / MFA
  • Cryptography
  • Hardening
  • IoT security
  • Risk management
  • Compliance

Infrastructure

  • Linux
  • Cloud
  • Containers & orchestration
  • Infrastructure as code
  • CI/CD
  • Virtualisation
  • Backup & DR
  • Firewalls
  • Network segmentation
  • TCP/IP & routing
  • BGP / OSPF / EIGRP
  • VLAN / IPv6
  • VPN / IPsec
  • DNS & DHCP
  • Shell scripting
  • Programming

Delivery

  • Technical project management
  • Requirements
  • Architecture documentation
  • Report writing
  • Routines & processes
  • Business development
  • Training & lectures
  • Knowledge sharing
// Education
Since forever · still enrolled

Self-taught — the long way round

Curriculum: man pages, RFCs, cryptic error messages and a frankly irresponsible number of browser tabs. Lab work: my own machines, mostly by breaking them. Examiner: a compiler that does not accept excuses. Graduation date: never — the syllabus keeps shipping new CVEs.

// Principles
Least privilege
Applies to people, too
Signal > noise
Fewer alerts, better ones
Document it
Or it didn't happen
Automate
The second time, not the first
Leave it better
Fixes that outlive the project