Principal DFIR Technical Architect at Unit 42 (Palo Alto Networks)
Threat Intelligence • DFIR • Detection Engineering • Applied AI for Security
13+ years across incident response, threat hunting, intrusion analysis, and detection engineering—from holding a DoD Top Secret clearance at MIT Lincoln Laboratory to leading critical breach and zero-day investigations at Unit 42. I build production Python tooling, data pipelines, and multi-agent/LLM systems that turn raw telemetry into attributed intelligence.
- Languages & Frameworks: Python, XQL, SQL, Google ADK, LangChain/LangGraph
- Detection & Analytics: Sigma, YARA, Suricata, SIEM/XDR Query Languages
- AI & LLM Security: MCP (Model Context Protocol), OWASP LLM Top 10, MITRE ATLAS
- Adversary Tracking: Investigating nation-state and advanced criminal infrastructure (APT, ransomware/RaaS, DPRK insider threat operations, and zero-day exploitation).
- Threat Intel Automation: Architecting data pipelines and autonomous AI agents to accelerate collection, enrichment, and triaging.
- Defending AI Infrastructure: Developing practical, production-grade detection rulesets to secure LLM applications and model supply chains.
- 🌟 ai_for_the_win - An open-source training program featuring 50+ hands-on labs and CTF challenges covering ML, LLMs, RAG, threat detection, DFIR, and red teaming.
- 🤖 AI-Powered-Ransomware-Intelligence-Agent - An automated n8n + Claude pipeline designed to ingest leak-site data and convert it into structured, MITRE ATT&CK-mapped cyber threat intelligence.
- 🧰 ai-dfir-toolkit - A vendor-neutral repository of Sigma, YARA, and Suricata rules deployed to detect prompt injection, model supply-chain vulnerabilities, and attacks targeting AI infrastructure.
- SANS "Stay Ahead of Ransomware" Series | Featured Speaker alongside Ryan Chapman and Mari DeGrazia
- "The AI Arms Race: When Both Sides Have Copilots"
- "Building an AI-Powered Ransomware Intelligence Agent"
- LinkedIn Profile
- DM me to collaborate on securing frontier models, automating DFIR workflows, or swapping notes on adversary infrastructure analysis.