Rochester, MN · Security Engineering & Operations · Rev 2026.09
Security engineering, tested and bounded.
Detection engineering, security operations, and assurance work built around careful investigation, tested automation, and clear documentation.
Prefer to inspect the code? Browse source on GitHub (opens in a new tab)
detection:
selection:
Image|endswith: '\certutil.exe'
CommandLine|contains|all:
- 'urlcache'
- 'split'
condition: selection<group name="windows, custom_sigma">
<rule id="200001" level="10">
<!-- sigma_uuid:c8d8b9e5... -->
<if_group>sysmon_event1</if_group>
<field name="win.eventdata.image"
type="pcre2">
(?i).*\\certutil\.exe$</field>
<field name="win.eventdata.commandLine"
type="pcre2">
(?=.*(?i).*urlcache.*)(?=.*(?i).*split.*)</field>
<description>Suspicious Certutil Network
Connection</description>
<mitre><id>T1105</id></mitre>
</rule>
</group>The pipeline parses Sigma logic, preserves stable rule IDs, and validates the generated XML before deployment. Read the full case study.
57 of 58 rules target Windows process creation
Method
4 rules / applied to every system below
A claim gets a corpus, not an example.
Ten MCP detection rules were not called working until they ran clean across 4,727 benign records and 541 sessions. A single demo capture proves the plumbing works, not that the rule stays quiet.
The limit ships with the result.
Three of twelve documented evasion classes have no signature I can write against them. That count sits on the project page beside the detections it qualifies, not in a footnote underneath them.
A wrong claim gets retracted, not quietly edited.
Assertion Desk’s own limitations file claimed one adversarial payload had a real path into a model prompt. Reading the code found a second path the file never accounted for. The corpus grew from four cases to nine, and I published the correction instead of editing the file quietly.
Silence is not verification.
The MCP review framework records control state on a six-value
model where an absence of telemetry indicators can never return
verified. Nothing alarmed is a fact about the
sensors, not about the control.
Selected work
5 systems / 2025 to 2026
A from-scratch Sigma-to-Wazuh compiler with validation gates, stable rule identity, and API deployment behind a dry run.
58 Sigma → 216 Wazuh rules
119 ATT&CK techniques, 14 tactics
87 automated tests
57 of 58 rules target Windows process creation
An approval-gated environment where identity, endpoint state, ticketing, alerts, approvals, and audit evidence run as one executable chain. Every privileged action passes a recorded policy decision.
2,092-case policy parity
90 of 108 privileged attempts denied
1,631 audit records, chain valid
Synthetic environment, not a production platform
Captures MCP tool-call traffic and turns it into evidence a human reviewer can act on: bounded detections, trust-boundary inventory, and measured blind spots.
10 rules, 5 abuse techniques
4,727-record benign corpus
12 documented evasion classes
3 of 12 evasion classes are structurally undetectable
An Authentik SSO perimeter wired to Canarytokens and a Python enrichment service, built to study high-signal identity tripwires.
Authentik + Canarytokens
Flask webhook processor
AbuseIPDB enrichment, ARM64 lab
Proof of concept, not a production identity control
A SAML sign-in failure diagnosis pipeline where a deterministic verifier establishes the facts and a grounding gate rejects any model claim the facts do not support.
55 SAML cases, 94.5% disposition accuracy
6 of 6 reachable injection payloads resisted
0 secrets across 280 recorded prompts
Keycloak only, and the AI path still trails the deterministic path
Writing
3-part series / 2026
Ten rules measured against a 4,727-record synthetic benign corpus with zero alerts, and ten evasions that still defeat them.
What Simple Cache preserves after history is cleared, and a Python workflow that extracts, hashes, and reports it.
Contact
I'm seeking junior security operations, detection automation, assurance, and IT roles. I am also open to scoped project conversations that need careful testing and documentation.