0xv1n

Design and lead risk-based adversary emulation against an enterprise macOS fleet, targeting endpoint control evasion and host-hardening gaps. Test Jamf profiles and scripts, validate public exploits and variants, and perform application security testing with root-cause analysis and proof-of-concept code. Partner with detection and response teams on purple team engagements and extend TTPForge to automate validation.

Led threat research and engineered high-fidelity detection logic across Windows and macOS endpoint, identity, and SaaS telemetry. Built a modular threat intelligence platform, drove OCSF data standardization, and developed reusable Jupyter tooling over petabyte-scale Snowflake datasets. Designed the team's first CI/CD pipelines for automated validation and deployment of detection content.

Co-presented with MITRE and Palo Alto Unit 42 on Remote Monitoring and Management abuse. Standardized taxonomy for a library of more than 5,000 detection analytics, built automated response playbooks in Ruby and Go, and contributed validated Atomic Red Team tests and Sigma detection rules.

Delivered Tier 3 incident response and intrusion support for Fortune 100/1000 clients. Led customer-facing investigations and proactive hunts targeting activity that evaded automated controls. Mentored junior analysts, built Python and ServiceNow API tooling, and standardized analysis methods to improve hunting and response.