Cybersecurity @ UTSA
OT security and detection engineering.
I monitored production OT alerts in Dragos inside a regulated critical infrastructure energy environment at Marathon Petroleum. In industrial control systems coursework I analyzed how Suricata and Zeek detect live DNP3 and Modbus attacks, and I maintain my own Sigma detections mapped to MITRE ATT&CK. Graduating December 2026.
Every entry below is real, dated, and verifiable. Enterprise security operations first, then production OT monitoring, now the detection engineering and networking depth that industrial environments run on.
CompTIA Security+, AWS Cloud Practitioner, Microsoft AZ-900, and the Google Cybersecurity Certificate, alongside core work in Azure, AWS, networking, and Python.
Built an AWS SIEM pipeline forwarding GuardDuty findings through S3 and Firehose into OpenSearch, with dashboards and high severity alerting.
Monitored and investigated OT alerts in Dragos inside a regulated critical infrastructure energy environment, extending coverage across converged IT and OT. Owned alerts end to end in a flat SOC across Google SecOps, CrowdStrike Falcon, and Microsoft Defender.
Coursework attacking and defending simulated plant networks. Ran DNP3 Direct Operate and Modbus coil write attacks, analyzed how Suricata and Zeek caught them, compared rule fidelity, and wrote up the defenses. Write ups below.
Studying for the Microsoft Security Operations Analyst certification, targeted for late October, to formalize the SIEM and detection work I did day to day at Marathon.
Graduating from UTSA in December 2026 (BBA Cybersecurity, 3.75 GPA) and targeting SOC and detection roles. CCNA planned for spring 2027 to harden the networking foundation OT depends on, then ISA/IEC 62443 Cybersecurity Fundamentals Specialist in summer 2027.
At Marathon Petroleum I monitored production OT alerts in Dragos inside a regulated energy environment. In industrial control systems coursework at UTSA I worked the other side of that screen: running live protocol attacks in simulated plant networks and analyzing what the sensors did and did not catch. The rules and environments came from the course. The analysis, the fidelity comparisons, and the defense recommendations in both write ups below are mine.
OTForge · Ironhorse Midstream
An unauthorized compressor start command on a simulated natural gas gathering network, and what it takes to catch it. Why a raw byte match rule drowns in false positives where an application layer rule stays quiet, and what changes when the sensor moves from alerting to blocking.
Read the write up →OTForge · Meridian Petrochemical
An attack that pivots through an IP camera left on factory credentials, reaches a petrochemical OT network, and writes a Modbus coil to a Triconex safety controller. Why detection here has to be scoped by destination address: the safety system and the process controller are indistinguishable on the wire.
Read the write up →The enterprise side of the same practice. A small, growing library of platform agnostic Sigma rules mapped to MITRE ATT&CK, where one rule converts to KQL (Sentinel), SPL (Splunk), or YARA-L (Google SecOps). The point is not collecting rules, it is showing the thinking: technique → log source → logic → fidelity and tuning. Every rule here is fully documented before the next one starts.
| Detection | Tactic | Technique | Log source |
|---|---|---|---|
| Windows Security event log cleared | Defense Impairment | T1685.005 | Windows Security (1102) |
| Shadow copy deletion via vssadmin | Impact | T1490 | Windows process creation |
Each rule ships with a write up covering detection logic, expected false positives, and tuning notes.
Detections are only as good as your understanding of the environment they run in. These builds are the cloud and infrastructure foundation underneath the security work.
A cloud native SIEM built during my Trevenx internship. GuardDuty findings are forwarded through S3 and Firehose into OpenSearch for centralized log analysis, dashboards that update in real time, and high severity alert triggers. Lives under the Trevenx org.
14 documented labs covering identity, governance, networking, storage, compute, containers, data protection, and monitoring. Each lab is written up as its own report. Browse the index below.
Azure lab index · 14 write ups
Marathon Petroleum
Trevenx
TEKsystems (contracted to NRTC)
Allegiance Mobile Health
Detection & response
Cloud & identity
Automation & analysis
OT / ICS
Frameworks & process
Open to Fall 2026 internships and entry-level detection engineering or SOC roles. The fastest way to reach me is email or LinkedIn.