Security Operations & Detection Engineering | AI Security Researcher

Security+ certified analyst who defends a federal GovCon Microsoft 365 environment and builds the detections that catch attacks against it. I pair hands-on security operations (incident response, identity governance, NIST SP 800-171 compliance) with detection engineering in Microsoft Sentinel, and published AI security research on prompt injection and LLM defenses.

Currently building out my detection portfolio and studying for SC-200.

Three repositories that show the full lifecycle of a detection, from written rule to validated, automated delivery.

• detection-engineering Tuned KQL detections for Microsoft Sentinel and M365 Defender, each mapped to MITRE ATT&CK with threat context, false-positive notes, and validation steps.
• soc-detection-lab The self-built Sentinel and Wazuh lab where every detection is validated against real telemetry before I trust it.
• detection-as-code Version-controlled Sigma rules with a CI pipeline that validates and converts them to KQL on every commit.

Write the detection, prove it in the lab, automate the delivery. That is the loop.

Security operations and compliance Incident and phishing response, Microsoft Defender, Entra ID, Intune, and Purview DLP across a 50+ user GovCon environment. Primary author behind a perfect 110/110 NIST SP 800-171 SPRS score, with the organization at CMMC Level 1 today and actively preparing for Level 2. Raised Microsoft Secure Score from 54.5% to 83.6% across 30+ endpoints.

Detection engineering KQL and Sigma detections mapped to MITRE ATT&CK, validated in a self-built Sentinel and Wazuh lab and shipped through a detection-as-code pipeline. See the portfolio above.

AI security research Published survey on prompt injection attacks and defenses, plus a working Python classifier that detects injection patterns against a six-category taxonomy.

Security automation PowerShell, Python, Power Automate, and the Microsoft Graph API to automate identity lifecycle and IT operations, recovering 1,200+ staff-hours per year.

AI governance Authoring enterprise AI use policies and advising on safe, accountable AI adoption.

Hijacking the Prompt: A Survey of Prompt Injection Attacks, Detection, and Defense in LLMs Published through ODU Digital Commons. Includes a Python/Flask proof-of-concept classifier matching 13 injection signatures to a six-category taxonomy, validated by 83 passing pytest tests.

Vault 7: Cybersecurity Training Game Team Lead and Lead Developer for a four-person team building a browser-based security training game with mission-style scenarios on phishing, passwords, and defensive decisions. Selected as the winning project in the COVA CCI Design Cohort.

Security Operations · Detection Engineering · Microsoft Sentinel · KQL · Sigma · MITRE ATT&CK · Wazuh · Detection as Code · Incident Response · Microsoft Defender · Entra ID · Intune · Purview DLP · Conditional Access · NIST SP 800-171 · CMMC (L1 today, L2 in prep) · PowerShell · Python · Microsoft Graph API · Prompt Injection Defense · LLM Security

• CompTIA Security+ (SY0-701) — 2026
• Google Cybersecurity Professional Certificate (V2) — 2025
• Google AI Professional Certificate — 2025
• IBM Generative AI Essentials for Cybersecurity — 2025
• Microsoft SC-200: Security Operations Analyst (in progress)