I’m a cybersecurity professional with a master’s in cybersecurity engineering, working across two tracks: hands-on security operations — detection, investigation, and testing — and the governance, risk, and compliance side that turns findings into decisions a business can act on.
The work below is drawn from my graduate program and independent projects. Each piece links to the full document.
Digital Forensic Investigation
Determined whether system users communicated with and transferred files to remote parties. Acquired a forensic disk image and analyzed user profiles, installed software, program-execution artifacts, file access, Outlook (PST) email, and instant-messaging traces using Autopsy, RegRipper, FRED, and PST Viewer Pro — then established and documented evidence of the file transfers.
Open document →End-to-End Penetration Test
Full engagement against a target VM: host discovery and enumeration, TCP/UDP scanning with service and OS fingerprinting, a Nessus vulnerability assessment triaging critical / high / medium findings with remediations, and exploitation of two vulnerabilities (vsFTPd and UnrealIRCd backdoors) to a root shell, including credential cracking.
Open document →Lightweight Cryptography for a Sensor Network
Designed cryptographic services to protect a resource-constrained IoT sensor network against interception, replay, and tampering. Specified ASCON-128 lightweight authenticated encryption with nonce-based key derivation, HSM integration, key rotation, and at-rest encryption — with the rationale written to be clear to a non-technical stakeholder.
Open document →Information System Security Plan (ISSP)
A full ISSP mapping a fictional cloud environment against all 14 NIST SP 800-171 control families — access control, audit & accountability, identification & authentication, incident response, media protection, and system & communications protection — documenting per-requirement implementation, N/A rationale, and system boundaries for CUI. Structured as a work sample on a fictional case-study client.
Open document →Business-Driven Security Architecture (SABSA)
A SABSA business-attribute profiling work sample deriving security requirements from business drivers rather than technology: contextual and conceptual layers for a fictional firm — business drivers, a full attribute profile across seven stakeholder dimensions, organizational process model, and asset assessment — showing traceability from what the business values to what security must deliver.
Open document →Ransomware Risk Quantification (FAIR)
Applied the FAIR framework to quantify ransomware risk for a health-insurance provider. Decomposed loss event frequency into contact frequency, probability of action, threat capability, and resistance strength; modeled primary and secondary loss magnitude including regulatory fines and reputational fallout; and ran a Monte Carlo simulation in FAIR-U to produce an annualized loss-exceedance curve — translating technical risk into board-ready dollar figures.
Open document →Defense-in-Depth for a Small Business
A risk-based security advisory for a small-to-medium software business: layered, cost-conscious recommendations spanning authentication hardening (password policy, TOTP MFA), VPN-based secure remote access, physical security controls, and honeypot-based intrusion detection — framed around real budget constraints and defense-in-depth.
Open document →// More GRC work in progress —a privacy-by-design case study.