Detection engineering, offensive security, cloud, and the unglamorous controls that actually stop intrusions.
What it actually takes to run SIEM, EDR, and threat hunting for dozens of tenants on Wazuh and Elastic — without drowning in alerts or licensing fees.
After 50+ pentests, the report was the bottleneck — not the testing. Here's how I automated the boring parts while keeping the findings sharp.
Across AWS, GCP, and Azure, the same pattern keeps showing up — the breach isn't a clever exploit, it's an over-permissioned role nobody audited.
Routing pipelines and version-controlled correlation rules turned our detection content from tribal knowledge into something we can test and ship.
Sublime Security rules derived from real-world attacks, plus disciplined DMARC/SPF/DKIM — the unglamorous controls that stop most intrusions.