SOC Analyst, App Security @ ASM Research
Security operations across IT, OT, and AI.
I review third party apps for a frontier AI company's public app platform, hunting for prompt injection, unsafe tool calls, and sensitive data exposure before they publish. Before that I closed 300+ incidents in Marathon Petroleum's SOC, including production OT alerts in Dragos inside a regulated critical infrastructure environment. Long term, I'm building toward OT security. Cybersecurity senior at UTSA, graduating December 2026.
Every entry below is real, dated, and verifiable. Help desk and cloud first, then production IT and OT security operations, now AI app security, with OT as the long term destination.
CompTIA Security+, AWS Cloud Practitioner, Microsoft AZ-900, and the Google Cybersecurity Certificate, alongside core work in Azure, AWS, networking, and Python.
Network troubleshooting for 40+ rural ISPs at TEKsystems, then an AWS SIEM pipeline at Trevenx forwarding GuardDuty findings through S3 and Firehose into OpenSearch.
Triaged 50+ alerts weekly and closed 300+ incidents across CrowdStrike Falcon, Microsoft Defender, and Google SecOps, and monitored production OT alerts in Dragos inside a regulated critical infrastructure energy environment.
Coursework attacking and defending simulated plant networks. Ran DNP3 Direct Operate and Modbus coil write attacks, analyzed how Suricata and Zeek caught them, compared rule fidelity, and wrote up the defenses. Write ups below.
Reviewing third party apps for a frontier AI company's public app platform against a 27 check security policy framework, closing 25 to 30 cases a day. Studying for CompTIA CySA+ alongside.
BBA in Cybersecurity, 3.75 GPA, President's List. Then deeper into OT security.
After CySA+, in no fixed order: Cisco CCNA for the networking depth industrial environments run on, ISA/IEC 62443 for industrial automation and control systems security, and possibly CompTIA SecurityX.
At Marathon Petroleum I monitored production OT alerts in Dragos inside a regulated energy environment. In industrial control systems coursework at UTSA I worked the other side of that screen: running live protocol attacks in simulated plant networks and analyzing what the sensors did and did not catch. The rules and environments came from the course. The analysis, the fidelity comparisons, and the defense recommendations in both write ups below are mine.
OTForge · Ironhorse Midstream
An unauthorized compressor start command on a simulated natural gas gathering network, and what it takes to catch it. Why a raw byte match rule drowns in false positives where an application layer rule stays quiet, and what changes when the sensor moves from alerting to blocking.
Read the write up →OTForge · Meridian Petrochemical
An attack that pivots through an IP camera left on factory credentials, reaches a petrochemical OT network, and writes a Modbus coil to a Triconex safety controller. Why detection here has to be scoped by destination address: the safety system and the process controller are indistinguishable on the wire.
Read the write up →The enterprise side of the same practice. A small, growing library of platform agnostic Sigma rules mapped to MITRE ATT&CK, where one rule converts to KQL (Sentinel), SPL (Splunk), or YARA-L (Google SecOps). The point is not collecting rules, it is showing the thinking: technique → log source → logic → fidelity and tuning. Every rule here is fully documented before the next one starts.
| Detection | Tactic | Technique | Log source |
|---|---|---|---|
| Windows Security event log cleared | Defense Impairment | T1685.005 | Windows Security (1102) |
| Shadow copy deletion via vssadmin | Impact | T1490 | Windows process creation |
Each rule ships with a write up covering detection logic, expected false positives, and tuning notes.
Detections are only as good as your understanding of the environment they run in. These builds are the cloud and infrastructure foundation underneath the security work.
A cloud native SIEM built during my Trevenx internship. GuardDuty findings are forwarded through S3 and Firehose into OpenSearch for centralized log analysis, dashboards that update in real time, and high severity alert triggers. Lives under the Trevenx org.
14 documented labs covering identity, governance, networking, storage, compute, containers, data protection, and monitoring. Each lab is written up as its own report. Browse the index below.
Azure lab index · 14 write ups
ASM Research · Contracted to a frontier AI company
Marathon Petroleum · Cybersecurity Incident Detection and Response Team
Trevenx
TEKsystems
Allegiance Mobile Health
Security operations and IR
AI and application security
Detection and automation
OT and ICS
Cloud and identity
Networking and frameworks
Always happy to talk about security operations, detection engineering, OT security, or reviewing AI apps. The fastest way to reach me is email or LinkedIn.