resume

Master of Science

Georgia Institute of Technology, Atlanta, GA

Computer Science

• Graduated with Highest Honors
• Specialization in Computing Systems

Bachelor of Science

Georgia Institute of Technology, Atlanta, GA

Computer Science

• Graduated with Highest Honors
• Specialization in Systems and Architecture and Information Internetworks
• Concentration in International Affairs
• RoboJackets Robot Sumo Team Software Lead

Lead Cloud Security Engineer

Praetorian Security, Inc.

• Leading penetration tests and configuration reviews against cloud environments and applications for external clients; 3,500+ billable hours and >10 critical/high findings
• Delivering strategic recommendations to key stakeholders regarding the security posture of their digital infrastructure and assets; >9.5 Net Promoter Score.
• Developing new methodology and tools to assess cloud and IAM configurations.
• Supporting sales discovery calls as a subject matter expert.
• Providing guidance for junior engineers to solidify their offensive security foundations.

Security Consulting Engineer

Cisco Systems, Inc.

• Performed offensive security engagements for external clients; 4,500+ billable hours.
• Developed and maintained Python framework to automate triage of vulnerability scanner alerts in backbone network fabric for Fortune 15 information technology company. ~30k LoC.

Head Teaching Assistant

Georgia Institute of Technology - Institute of Security and Privacy

• Developed labs and exams for brand new CS 6264 – System and Network Defenses online graduate course for the top ranked cybersecurity program in the country.
• Labs included: binary exploitation, end-point security with kernel hooks, and Android WebView phishing attacks.

Graduate Research Assistant

Georgia Institute of Technology – Institute for Information Privacy and Security

Research assistant for Dr. Wenke Lee's GTISC lab (now the Georgia Tech School of Cybersecurity and Privacy)

• Developed a browser-based auditing approach for watering hole-based cyber-attacks by overcoming limitations relating to recording necessary semantic information instead of just viewing system calls

Security Operations Center Analyst

Georgia Institute of Technology - Office of Information Technology

Analyzed and triaged security alerts raised by campus endpoint monitoring systems by crafting searches in Splunk, FireEye HX, and other in-house solutions.

AzureHound

Extension to existing AzureHound project to enumerate Azure subscription RBAC roles, RBAC role assignments, and service principal assignments. Written in Go, ~4k LoC.

ScentTrail

Command-line utility to extend an existing Bloodhound Neo4j graph database to identify vertical privilege escalation based on Azure RBAC permissions. Written in Python and Neo4j, ~1k LoC.

Azure RBAC Privilege Escalations: Azure VM

Praetorian

Authored article covering covering four methods attackers can use to escalate privileges in Azure subscriptions by leveraging their Azure VM permissions.

Why Azure B2C ROPC Custom Flows Are Inherently Insecure

Praetorian

Authored article investigating the default Azure B2C ROPC flow used for token issuance. Specifically, the flow could be abused by creating authorization tokens with arbitrary scopes.

Mnemosyne: An Effective and Efficient Postmortem Watering Hole Attack Investigation System (CCS ’20)

Association for Computing Machinery

Contributed to research in the detection and investigation of watering-hole attacks against frequently-visited websites. The forensic analysis engine developed as part of this research was a lightweight browser-modification-free auditing daemon that reduced the amount of manual analysis required by the forensic analyst by about 98%.

Crypto Village Volunteer

Hak4Kidz

Held a cryptography workshop for a children's ethical hacking conference.

• Led workshop during the conference
• Developed worksheets to teach basic cryptography concepts to children ages K-12

Engagements Subcommittee Liaison

DSA National Tech Committee

Steering Committee member responsible for communications to the NTC membership.

• Creating monthly newsletters
• Leading onboarding meetings to generate interest in the NTC
• Developing pilot for open-source membership management solution
• Contributed to dues payments website development