Career

Roles

• 2024 – presentnow2024

  Palo Alto Networks · 20 engineers across 3 teams

  Engineering Director, Threat Data Platform

  The threat intelligence backbone of the Palo Alto Networks product suite.

  Responsible for

  • Architecture, operations and deployment of large distributed systems — web interfaces, REST and gRPC services, ML and AI applications, and high-scale data processing pipelines.
  • Three teams: data platform engineering, platform services engineering, and research engineering.
  • Early architecture and prototyping on new initiatives, personally.

  Delivered

  • Consolidated fragmented threat intelligence sources into a single reconciled model — schema design, entity resolution, API contract discipline — now consumed internally and across the product suite.
  • Drove an AI-first delivery model that compressed major-initiative timelines from years to weeks.
  • Bootstrapped Threat Detection Engineering from a personal proof of concept into a team and a production pipeline, then handed it to a principal engineer to scale — a Cloud Spanner graph resolving overlapping entities into bundles that tell a threat's story, with autonomous Gemini and ADK workflows working the data-quality problems it surfaces.
  • Shipped an internal expert agent — grounded entirely in retrieved authoritative data rather than the model's own recall, with structured tool calls holding a trust boundary between untrusted users and a semi-sensitive dataset.

  • Python
  • gRPC
  • REST
  • GCP
  • Cloud Spanner
  • BigQuery
  • Bigtable
  • AI Agents
  • SQLite
  • React
  • amCharts
  • Gemini
  • Google ADK
• 2020–202420242020

  Palo Alto Networks · 30 people, 4 sub-teams

  Engineering Director, Unit 42

  Threat research engineering for Unit 42, operating with startup autonomy inside a public company.

  Responsible for

  • Security automation, DevOps, and operational intelligence sub-teams.
  • Cross-business-unit relationships and partnership with dozens of internal consumers.

  Delivered

  • Scaled a single threat intelligence research capability across dozens of independent internal teams.
  • Grew technical leaders and built career pathways spanning technical, leadership and professional tracks.

  • Python
  • SQLite
  • React
  • amCharts
• 2015–202020202015

  Palo Alto Networks · Skunkworks research team

  Senior Manager, Global Security Research Team

  A rapid-prototyping team for research tooling and data analysis.

  Responsible for

  • Automated malware analysis tooling, research workflow interfaces, and infrastructure automation.
  • DevOps for both production and laboratory research infrastructure.

  Delivered

  • Designed and wrote the AutoFocus client library from scratch — still foundational to internal tooling.

  • Python
  • REST
  • Cassandra
  • SQLite
  • React
  • jQuery
  • jQuery UI
  • amCharts
  • Highcharts

  extensible-client-libraries on the blog

• 20152015

  Ionic Security · Startup security organisation

  Director, Security Operations

  Built and grew security operations at an Atlanta security startup.

  Responsible for

  • The security operations organisation: hiring, process, and operational clarity.
  • Architectural guidance for secure network and system design.

  Delivered

  • Enabled analysts and engineers through better process and tooling rather than headcount.
• 2014–201520152014

  Blizzard Entertainment · 15-person security org, hundreds of engineers supported

  Senior Security Engineer

  Senior technical security voice across game teams that operated as independent studios.

  Responsible for

  • Security architecture guidance across network, system and application domains, in a federated studio model.
  • WAF policy design and tuning for customer-facing systems; DDoS mitigation on Imperva appliances.
  • Incident response leadership when escalations needed a senior technical voice.

  Delivered

  • Partnered with GRC to translate technical capability into compliance requirements.
  • Ran content analysis on game releases to validate secure delivery.

  • WAF
  • Imperva
  • Oracle DB
  • SQLite
• 2013–201420142013

  Dell SecureWorks · 7 developers

  Senior Security Researcher, Team Lead

  Led the engineering team supporting the Counter Threat Unit, one of the industry's pioneering threat intelligence groups.

  Responsible for

  • Product evaluations, architecture consulting, and workflow development.
  • Cross-departmental initiatives on behalf of the research group.

  Delivered

  • Supported a threat intelligence group that operated like a startup inside the company.

  • Python
  • Perl
  • Beanstalkd
  • RabbitMQ
  • SQLite
  • jQuery
  • jQuery UI
  • Highcharts
  • Reverse Engineering
  • YARA
• 2011–201320132011

  Dell SecureWorks · Individual contributor

  Security Researcher

  Rapid prototyping and large-scale data work for threat research.

  Responsible for

  • ETL, malware analysis, data aggregation, systems architecture, and internal tooling.

  Delivered

  • Built an automated malware analysis system.
  • Fully rewrote the internal CMS.

  • Python
  • Perl
  • Beanstalkd
  • RabbitMQ
  • SQLite
  • jQuery
  • jQuery UI
  • Highcharts
  • Reverse Engineering
  • YARA
• 2008–201120112008

  SecureWorks · Individual contributor

  Operational Intelligence Engineer

  Turning raw security telemetry into usable operational signal.

  Responsible for

  • ETL pipelines, analytics dashboards, and rule-based detection systems.
  • IDS/IPS tuning and Snort rule authoring.

  Delivered

  • Built remote agent health monitoring behind a Java Web Start interface.

  • Perl
  • Java
  • Snort
  • MySQL
  • MariaDB
  • Linux
  • GDB
  • Reverse Engineering
  • Packet Analysis
  • iptables
  • Cisco PIX
  • Check Point
  • Windows Log Analysis
  • Application Log Analysis
  • SQLite
  • YARA
• 2006–200820082006

  LURHQ · Individual contributor

  Senior Security Analyst

  Senior analyst work on a managed security services floor.

  Responsible for

  • Log analysis, regular-expression development, Snort tuning, and firewall configuration.

  Delivered

  • Developed the analysts who came after.

  • Perl
  • Regex
  • Snort
  • MySQL
  • Linux
  • GDB
  • Reverse Engineering
  • Packet Analysis
  • iptables
  • Cisco PIX
  • Check Point
  • Windows Log Analysis
  • Application Log Analysis
  • SQLite
• 2005–200620062005

  LURHQ · First role in the industry

  Security Analyst

  Where the career started: reading logs on a managed security services floor.

  Responsible for

  • Log analysis, regular-expression authoring, system administration, and remote agent configuration.

  Delivered

  • Co-developed TRUMAN (The Reusable Unknown Malware Analysis Net), extending a bare-metal malware sandnet into an internal production system — writing the Perl orchestration, telemetry collection, and analysis workflows. Joe Stewart authored the original proof of concept and holds public attribution for it. Nothing was virtualised, so it defeated VM-detection evasion years before that was widely understood, and predated Cuckoo Sandbox by five years.

  • Perl
  • Regex
  • MySQL
  • Snort
  • Linux
  • Windows
  • GDB
  • Reverse Engineering
  • Packet Analysis
  • iptables
  • Cisco PIX
  • Check Point
  • Windows Log Analysis
  • Application Log Analysis
  • SQLite