About Me

## How I Got Here

I have a degree and a number of active/historic credentials in Cybersecurity, but I am fundamentally self-taught. It started at twelve, on drummerworld.com, reverse-engineering embedded drum videos from page source to learn proper drumming technique — and, accidentally, figure out how the web worked. I'd find a drummer whose technique I wanted, open the page source, find the video URL, and grab it. To get the file onto my mom's computer I learned enough HTML to post the link on my MySpace page for a minute, download it, and take it down. Then I'd play it back in slow motion and pick apart what the drummer's hands were doing in the one part of the song I cared about. That curiosity never left. I just pointed it at networking, security, and automation. I wrote about that in My Lane Is a Method.

Security has been the day job since 2015. It started with a Cybersecurity work-study at Front Range Community College and an HPE internship on the USPS enterprise security account. Then analyst/administrative work at KIOSK Information Systems, where I managed security alone for ten client organizations and 10,000+ endpoints, in a role progressing from junior- to mid-level. Then EDR, Email, SIEM, and MDM security engineering work at Zayo, a Tier 1 fiber provider, and then network security engineering there as one of two network security engineers on a six-person security team: Palo Alto firewalls, threat hunting across thousands of endpoints, and Splunk dashboards I built at odd hours because the alert I needed didn't exist yet.

For the last ~4.5 years I've been a cloud security consultant (security engineer/architect) at AWS Professional Services, helping enterprises build, assess, and secure their cloud environments. The tools and the dates are on the résumé.

## What I Actually Do

I've spent the last ~4.5 years helping AWS's highest-profile customers secure what they run on AWS, no matter the industry: healthcare, government, telecom, aerospace & defense, financial-services, education-tech.

Multi-Region IPAM on AWS. AWS published my multi-Region IPAM architecture as Prescriptive Guidance, and I open-sourced the IPAM Terraform code (67 pools, 874 resources, six Regions, cross-account sharing via AWS RAM) on aws-samples.

Cloud governance and compliance-as-code. Policy-as-code guardrails for regulated customers: Service Control Policies, custom AWS Config rules, Security Hub CSPM and GuardDuty, Landing Zone Accelerator baselines.

Shift-left DevSecOps. I rebuilt one customer's failing CI security scans into a suite of 15+ scanners that only scan what changed. On that broker-dealer's platform I inherited a pipeline where one tool failing killed the whole run and nobody read the output anymore. Most of the work was making the results trustworthy, not adding scanners. I wrote that up here.

GenAI and agentic-AI security. I wrote the threat model for the same broker-dealer's Amazon Bedrock GenAI platform: 127 threats across 15 assets. I also do OWASP LLM Top 10 reviews and Model Context Protocol (MCP) security work, and I built a tool that writes least-privilege IAM policies from plain English, which consultants have used on at least seven engagements. I find this the most fun of the four right now.

## How I Think About the Work

Automate the bottleneck. Most of my best work started as me being annoyed at doing something manually. An AWS-internal review process had a year-long backlog. I wrote an analyzer for it and the backlog was gone in a week. The outcomes for that kind of thing are usually one of three: it gets adopted, it gets handed to a team that owns it properly, or it gets laughed at. All three are fine.

Honest about trade-offs. Everything has a cost... time, money, complexity, security. The right balance isn't the same for everyone. I'll help you find yours.

## Beyond the Terminal

When I'm not thinking about cloud architectures, I'm usually somewhere in the Colorado mountains, hiking, skiing, or finding a reason to be outside. My fiancée, Kayla, paints. I built her portfolio site.

The security career and drumming/music ran side-by-side for many years. I'm a drummer and percussionist, and from 2015 to 2022 I played drums for Kroenke Sports & Entertainment (KSE) — in-game for the Avalanche (NHL), Nuggets (NBA), and occasionally the Rapids (MLS) and Mammoth (NLL), and on call for whatever else KSE put on — at night, after my Cybersecurity day-job. Thanks to KSE, I got to entertain audiences attending games during the Avalanche's 2022 Stanley Cup run (Go Avs.), the London NBA Global Games with the Nuggets, and two nights at Red Rocks: one with the funk band Lettuce, one sold-out night with Kacey Musgraves. I also played in a funk band, SYLVA. We put out an album, Come Alive, in 2018 and broke up in 2020.

Security was the day job through all of it: KIOSK, then Zayo. The year I started at AWS, in 2022, I put the drums away and doubled-down on professional development.