About

I build detection systems and then look for where they stop working. Day to day that means detection engineering and security monitoring, with offensive work alongside it that I use to test my own rules.

The parts I spend most time on are telemetry quality, detection logic, attacker behaviour and validation, with systems and networking underneath and enough Python to keep the work repeatable. The case a rule misses tells me more than the case it catches, so the write-ups here give failure conditions as much room as results.