Birmingham, Alabama
I secure networks, run the systems under them, and keep the people using them working.
I run a network end to end — the perimeter, the systems on it, and the monitoring over the top.
Three résumés go out under my name: security analyst, systems administrator, network technician. They are not three people. They are one job described three ways, and all of it runs on the same network — one I built, exposed to the internet on purpose, and have been the only person responsible for since. There is no team to hand a ticket to. The firewall rule, the domain controller, the container that stopped resolving and the detection rule that catches someone probing all of it are the same week’s work.
Seven parts of the same job. Each one opens if you want the detail.
A Wazuh 4.14 deployment across manager, indexer and dashboard tiers, Filebeat shipping endpoint, file-integrity, configuration and authentication telemetry into the OpenSearch cluster, alerts mapped to MITRE ATT&CK. I write the rules myself, in XML: brute force, privilege escalation, persistence, container security, and attacks aimed at the monitoring stack itself, including multi-event correlation that identifies a successful authentication following failed attempts from the same source. One rule caught an unauthorised authorized_keys write — the primary Linux persistence technique, T1098.004 — within seconds of the event. I cut detection latency on credential and configuration paths from a twelve-hour scheduled scan to sub-second by moving critical directories to inotify-based file integrity monitoring, and measured it before and after. I remove false positives with targeted exclusions and root-cause analysis rather than broad suppression, so coverage on DNS configuration tampering survived while the application noise went away. Security Configuration Assessment runs against the CIS Debian Benchmark as a hardening baseline I can actually count.
I took the ISP gateway out of the routing path, put it in bridge mode, and consolidated routing, DHCP, DNS, NAT and firewalling onto pfSense virtualised on a Proxmox VE Type 1 hypervisor. Every north-south packet now crosses one inspected control point instead of going around it, with Suricata inline doing stateful packet inspection against custom rule sets. VLANs and subnets isolate infrastructure from services from clients, inter-VLAN policies enforce least privilege between them, and WPA3 wireless clients land in a restricted segment by default. DNS resolves recursively through Pi-hole and Unbound with DNSSEC validation rather than being forwarded to a third party, with sinkholing for malicious and telemetry domains and query logs mined for anomalous lookups and command-and-control callbacks. WireGuard handles remote access, per-peer preshared keys layered over public-key authentication with allowed-IP scoping.
A Windows Server 2025 domain controller running Active Directory Domain Services — three users across four operating systems on two physical machines — with security groups, RBAC and least privilege enforced per role through Group Policy. Endpoints enrol through Microsoft Intune on a Microsoft 365 tenant for compliance policy and configuration profiles. Underneath sits a Proxmox VE hypervisor running Linux VMs across segmented networks, and a TrueNAS SCALE platform on a ZFS pool where I manage datasets, SMB and NFS shares, snapshots, pool health and capacity against real thresholds.
Media streaming, indexing, request management, download automation and subtitle processing, serving several concurrent users. I migrated the whole stack off the TrueNAS application catalogue onto declarative Docker Compose files managed through Dockge, which turned a rebuild from something I remembered into something reproducible and version-controlled. Dozzle centralises container logs so I can troubleshoot without shelling into each one. NGINX Proxy Manager is the only door in, mapping public hostnames to internal endpoints with TLS terminated at the edge and the certificate lifecycle automated — because certificates that expire quietly take services down loudly. I once traced a cross-application failure where an upstream retention setting was silently breaking downstream imports and causing repeated redundant downloads, and fixed the pipeline rather than the symptom.
Published services take continuous unsolicited scanning, credential stuffing and content enumeration, so detections are validated against real hostile traffic instead of simulated attacks. When something does land, the process is the same one I would run anywhere: triage, contain, preserve evidence and chain of custody, document, escalate. I identified and reported a credential-harvesting phishing campaign impersonating university faculty, documenting the sender-domain mismatch, the social-engineering pressure techniques and the fraudulent-instrument objective, and produced a formal incident report with indicators of compromise, ATT&CK technique mapping, the assessed attack chain, impact analysis and detection recommendations — then reported it to the institution so they could notify more broadly.
At C Spire I supported the whole customer path, from the fibre handoff at the optical network terminal through customer edge routing and switching to the firewall, Layers 1 through 4, on Cisco Meraki, Ubiquiti and Plume hardware including SD-WAN and wireless deployments. Everything moved through ServiceNow and Jira Service Management against real SLA and escalation targets. I isolated DNS resolution, subnet mask, VLAN tagging and routing faults with structured OSI-model methodology and packet-level analysis in tcpdump, and worked with Tier 2 to verify a finding before a truck rolled — then confirmed the fix with the customer afterwards. Before that, at O’Reilly, I diagnosed vehicle faults by structured elimination and hands-on electrical testing, confirming against measured results and explaining them to people with no mechanical background. Testing before concluding started there.
ScanForge is a multi-tenant external attack-surface assessment platform that managed service providers resell to their own clients: a strictly passive, non-intrusive, read-only engine covering SPF, DKIM and DMARC email authentication, TLS and HTTPS configuration, HTTP security headers and domain and WHOIS exposure, with an analysis layer that turns raw output into a 0–100 posture score and plain-language remediation. Next.js, TypeScript and PostgreSQL, Dockerised, with per-tenant data isolation and a Content Security Policy enforced throughout. Red Whistle is a palm-sized personal-safety device and the app around it, where I designed RWP-1, a cryptographically signed mesh relay protocol carrying authenticated alerts over LoRa with no cellular infrastructure — message signing and replay protection in embedded C on the nRF52840.
Every technology below is one I have actually operated — in the environment described above, at C Spire, or in the products I build. Nothing here is a familiarity claim.
The network itself. Topology, the SIEM tiers, the perimeter, and the build log — including the parts that are unfinished. This is the environment every claim on the three résumés traces back to.
ENTER NERVHQ →Live progress through the B.S. in Cybersecurity and Information Assurance: every course, what it teaches, and which certification it produces — with earned separated from scheduled rather than blurred together.
VIEW THE RUNWAY →Notes from building and breaking things — detection engineering, network architecture, and the failures that taught me the most.
READ THE POSTS →A palm-sized personal-safety device and the app around it. I designed RWP-1, a cryptographically signed mesh relay protocol that carries authenticated alerts over LoRa with no cellular infrastructure, implementing message signing and replay protection in embedded C on the nRF52840. The Android app is in closed testing on Google Play.
A multi-tenant external attack-surface assessment platform that managed service providers resell to their own clients. The engine is strictly passive and read-only — SPF, DKIM and DMARC, TLS configuration, HTTP security headers, domain and WHOIS exposure — and an analysis layer turns raw output into a scored, risk-ranked report a non-technical owner can act on. Next.js, TypeScript and PostgreSQL, deployed in Docker.
Monitored customer connectivity, routing devices and traffic flows across a regional telecom base. Triaged and tracked incidents in ServiceNow and Jira Service Management against SLA, configured Meraki and Ubiquiti routers, switches and firewalls, and isolated DNS, subnet, VLAN-tagging and routing faults using structured OSI methodology and packet-level analysis. Partnered with Tier 2 to verify findings before dispatching field technicians.
Built a domain controller running AD DS for three users across four operating systems on two physical machines, enforcing least privilege per role through Group Policy, managing endpoint compliance through Intune, and running the whole support workflow in Jira Service Management with written incident reports on closure.
Diagnosed vehicle faults by structured elimination and hands-on electrical testing, confirming findings against measured results rather than guesses, and explained them to people with no mechanical background in a high-volume walk-in and phone environment. The habit of testing before concluding started here.
CERTIFICATIONS — CompTIA A+ Core 1, passed · A+ Core 2, in progress ·
Network+, in progress · Security+, in progress · Microsoft Office Specialist.
EDUCATION — Western Governors University, B.S. Cybersecurity and Information
Assurance, expected December 2026.