How I work

Background

• Vulnerability Management Analyst, Orlando Health (08/2025–06/2026) — Tenable platform operations in a HIPAA/ePHI environment: SLA tracking, SOC triage, remediation coordination.
• B.S., ECPI University (May 2024, summa cum laude) — CAE-CD designated program.
• CompTIA Security+ · EC-Council C|EH — plus National Cyber League top rankings and team captaincy, and TryHackMe top 1%.
• Career changer — licensed massage therapist 2014–2025 before moving into security full-time. Everything on this site was built nights and weekends first.

Principles

• Evidence over claims. Every release gets a SHA-256 session manifest. The source carries an ownership-verification record with SHA-256/512 fingerprints anyone can recompute. This site follows the same rule: each number maps to a file I can show you.
• Standards, not vibes. RFC 6962 Merkle proofs, RFC 3161 timestamps, DSSE/in-toto attestation, NIST SSDF / OWASP ASVS / CIS control mappings — implemented and tested against the specs' own vectors where the spec publishes them.
• Honest limits, in writing. Every README has a "what this version does NOT do" section. A tool that hides its boundaries is a tool an operator will eventually trust wrongly.
• Read-only contracts between components. TTM and the dispatcher consume the analyzer's state without ever writing upstream. Integration bugs get found at seams; narrow contracts keep the seams auditable.
• Dry-run first. Anything that touches an external system of record ships with a dry-run mode that writes reviewable payloads to disk before a single live call is made.
• Shipping is part of engineering. Trademark-safe naming, Partner Center identity, MSIX packaging, IV code signing, Store certification — then the whole path written down as a repeatable playbook.
• Key custody. GPG key backup procedures, Tailscale tailnet lock for network trust, YubiKey-gated release signing.

Skills

• Python (PyQt6, Textual, cryptography, orjson, SQLite/WAL)
• Vulnerability management: Tenable.io API, SLA policy design, KEV/NVD/ZDI intel
• Applied crypto: Fernet, HMAC chains, Ed25519, Merkle proofs, DSSE/in-toto
• Secure SDLC: Bandit, Semgrep, gitleaks, pip-audit, CycloneDX SBOM, pip-licenses
• Release engineering: Nuitka, MSIX, Authenticode/IV signing, Store certification
• Compliance mapping: NIST SSDF, OWASP ASVS, CIS Controls, HIPAA, NIST 800-53/800-171
• Testing: pytest/unittest at scale (329 tests), spec-vector testing, mock-server e2e
• ServiceNow integration design: CMDB reconcile, idempotent ticketing, dispatch state machines

Contact

Looking for roles in vulnerability management, security tooling, and security software engineering. Everything on this site was built solo, so I'm comfortable owning a problem from raw idea to signed, published, compliance-evidenced release — and equally comfortable being handed the ugly bug nobody can reproduce.