skills

Technical skills & core competencies

The areas I work in day to day: investigation, hunting, response, and the tooling and communication around them.

01Managed Detection & Response (MDR)

Security alert triage, investigation, escalation, remediation, and incident closure
High-severity endpoint, identity, email, and cloud security investigations
True-positive / false-positive determination and detection validation
Incident scoping, root-cause analysis, containment, and remediation planning
Investigation of complex or ambiguous security events using multiple telemetry sources
Security incident documentation, case management, and shift handoffs

Advanced investigation using CrowdStrike Falcon and SentinelOne Singularity
Process-tree, parent/child relationship, command-line, file, registry, network, and user-context analysis
Windows persistence analysis including scheduled tasks, services, Run/RunOnce keys, startup items, WMI, and registry-based persistence
Remote endpoint investigation and remediation using CrowdStrike RTR and SentinelOne Remote Shell
File collection, hash validation, signature verification, reputation analysis, and sandbox analysis
Endpoint containment, process termination, malicious file removal, persistence cleanup, and post-remediation validation
Windows forensic artifact analysis including Prefetch, LNK files, browser history, registry artifacts, and filesystem activity
Analysis of LOLBins, process injection, PowerShell execution, credential-access activity, and ransomware behaviors
Investigation of legitimate administrative and RMM tools to differentiate authorized activity from attacker abuse

Proactive threat hunting across endpoint and identity telemetry
Behavioral analysis across process, file, network, authentication, and persistence telemetry
Investigation of emerging techniques including ClickFix / fake CAPTCHA attacks, PowerShell download cradles, LOLBin abuse, and remote-access tool misuse

CrowdStrike Falcon LogScale / Event Search query development
SentinelOne Deep Visibility / XDR querying
Detection tuning and false-positive reduction
Development and maintenance of reusable investigation queries and analyst workflows

Microsoft Entra ID sign-in and identity-risk investigations
Analysis of suspicious authentication, MFA activity, impossible/unusual travel, anonymous infrastructure, session activity, and account compromise
Investigation of Kerberos authentication failures, account lockouts, LDAP activity, and Active Directory-related events
Microsoft Defender for Endpoint and Microsoft 365 security investigation
Session revocation, password-reset recommendations, account disablement, and identity containment guidance
Hybrid Active Directory / Entra ID investigation and correlation

Phishing, business email compromise, spoofing, malicious-link, and credential-harvesting investigations
Sublime Email Security investigation and remediation
Message-header, sender, domain, URL, delivery, and quarantine analysis
Identification of display-name spoofing, sender impersonation, postmaster abuse, and social-engineering techniques
Email quarantine, purge, and mailbox-compromise response guidance
Investigation of attacks delivered through external collaboration platforms, calendar invitations, and cloud-hosted documents

Static and behavioral analysis of suspicious executables, scripts, DLLs, installers, and archives
Authenticode / code-signing validation and publisher verification
Differentiation of malware, riskware, potentially unwanted applications, cracked software, administrative tools, and legitimate business software
PowerShell / AMSI script analysis
Investigation of unsigned, revoked-certificate, and low-prevalence binaries

Investigation of suspicious outbound connections, C2 indicators, IP reputation, domain activity, and geographic anomalies
AWS CloudTrail activity review and investigation of potentially destructive cloud actions
Correlation of endpoint activity with network, identity, cloud, and firewall telemetry
Analysis of VPN, firewall, and internal network authentication activity
IOC investigation and domain/IP blocking recommendations

CrowdStrike Falcon Prevent, Insight, Threat Graph, RTR, and LogScale
SentinelOne Singularity XDR, Deep Visibility, Remote Shell / RemoteOps, and Identity
Microsoft Defender for Endpoint
Microsoft Entra ID Protection
Microsoft 365 / Exchange Online security
Sublime Email Security
VirusTotal and malware sandbox platforms
AWS / CloudTrail
RMM and remote-access tooling including ScreenConnect, PDQ, NinjaRMM, Datto RMM, RemotePC, and similar administrative platforms

PowerShell investigation, interpretation, and remote-response workflows
Windows command-line utilities and administrative tooling
CrowdStrike LogScale query development
SentinelOne query development
Basic Python scripting for forensic analysis, file hashing, artifact comparison, and data processing
Registry, WMI, CIM, scheduled-task, service, and filesystem investigation
Development of internal analyst tooling and investigation utilities

MDR Team Lead experience supporting analyst investigations and operational decision-making
Review and escalation of complex security incidents
Analyst mentoring, investigation guidance, and quality assurance
Development of interview scenarios and technical assessments for MDR analyst candidates
Creation of analyst training scenarios, investigation exercises, and operational documentation
Coordination with DFIR, engineering, onboarding, and customer-facing teams
Case prioritization, workload management, and shift handoff coordination

Translation of complex technical investigations into concise client-facing findings
Development of remediation guidance based on investigation scope and business context
Direct communication with IT administrators, security teams, and technical stakeholders
Management of client escalations and follow-up investigations
Clear documentation of findings, response actions, limitations, and recommended next steps
Ability to distinguish security risk from expected administrative or business activity while minimizing unnecessary disruption