Signal, context, and the systems underneath.
Most of security is noise. My work is finding the people in it: who is behind an attack, how they operate, and what they will do next. I learned to read networks by running them, then by defending them, and I now build AI tools that help analysts read them faster.
Dial-Up & Wire
Keeping one of the last dial-up networks running, long after most of the world had moved to high-speed: modem banks and phone lines, maintained by hand. Fixing a connection meant understanding every hop between the wall jack and the wider internet.
Operations at Scale
Security monitoring for many organisations at once, each with its own network, tools and habits. A steady stream of alerts, most of them ordinary faults; the skill was knowing normal well enough to spot the one that was someone breaking in.
Threat Intelligence
Studying the people behind attacks, not just the attacks. Identifying how they operate, mapping the servers and domains they set up, and tracing influence campaigns back to their source. Then turning those fragments into assessments someone can act on.
Applied Intelligence
Building AI-assisted tools for the slow parts of analysis: reading, sorting, cross-referencing, drafting. Work that took hours takes moments, and an analyst still makes the call.