My software background helps me follow an incident through application behaviour, endpoint execution, identity and network activity. In investigations, I correlate the available evidence, build a timeline and make clear which conclusions the telemetry supports. My experience spans Microsoft 365 account compromise, staged PowerShell malware, VPN intrusion and remote-support abuse.
Studying computer science alongside philosophy broadened the questions I ask. Teaching computing to refugee children and helping teachers use digital tools made clear communication part of the work.
At UK Water Utility, that approach extends into KQL investigation queries, Microsoft Sentinel detection workflows, Defender for Endpoint Live Response scripts and ServiceNow SecOps integration testing. My offensive scoping has also included AI chatbot testing requirements, alongside on-prem Active Directory, email security and EDR coverage.