Security operations
Triaging endpoint detections and chasing signals to ground: CrowdStrike Falcon day to day, with Wazuh and Suricata in the lab, plus an AI-assisted triage layer I am building, to keep the instincts sharp.
Cybersecurity · SecOps · GRC engineering
Hi, I’m Bryan.
I help keep things secure, and prove it.
I’m a cybersecurity analyst at TriNetX, working across security operations and GRC engineering: catching threats on the endpoint, and turning controls into evidence that holds up in an audit. Before that came years of network engineering and IT support, which is why I still care how things actually connect. After hours I run a homelab as code to go deeper.
- B.S. Cybersecurity, summa cum laude
- CEH
- CompTIA Security+
- ISC2 CC
What I do
Security, from the signal to the audit
Two halves of the same job: spotting and handling what is happening now, and making sure the organisation can show it is doing the right things.
GRC engineering
Turning controls into something you can show: mapping them, collecting evidence and keeping audit readiness a habit rather than a scramble, with TrustCloud.
Network security
Years of firewalls, VLANs and multi-site WAN/LAN work behind me, now applied to secure web and zero trust access with Zscaler.
Homelab & automation
A four-node Proxmox cluster defined in Terraform and Ansible, deployed through CI, watched by a SIEM. Where I go deeper than the day job allows.
What I build for fun
The homelab: security work, with root
The best way I know to understand a control is to build the thing it protects. So my lab runs like production: everything described in Terraform and Ansible, every change through GitLab CI with a reviewed plan and a manual gate, a SIEM and an IDS watching over it, and a Zero Trust front door. I write the interesting bits up here.
- Proxmox nodes
- 4
- manual applies
- 0
- detection layers
- 2
- MCP servers
- 4
Featured projects
All write-upsAI-assisted alert triage
High-severity Wazuh alerts become tickets with a first-pass summary from a local LLM. A written playbook keeps me in charge, and a council of models gates any patching, failing safe to high risk.
Read the write-upPrivate repository
Homelab as code
A four-node Proxmox cluster described in Terraform and Ansible, driven entirely from GitLab CI. Reviewed plans, a manual approval gate, secrets loaded at run time, and no hand-applied changes.
Read the write-upPrivate repository
A Zero Trust front door
The domain moved to Cloudflare, services published through replicated Tunnel connectors, Access in front of every route and JWTs validated at the connector. Tailscale stays private, Tunnel stays public.
Read the write-upPrivate repository
Tools of the trade
What I reach for
- CrowdStrike Falcon
- Zscaler
- TrustCloud
- Wazuh
- Suricata
- Wireshark
- Nmap
- Cisco Meraki
- Cloudflare Zero Trust
- Tailscale
- Python
- PowerShell
- Bash
- SQL
- Java
- Proxmox
- Terraform
- Ansible
- Docker
- GitLab CI
- Linux
- MCP
Let’s talk security.
Hiring, collaborating, or just comparing detection rules? I’d love to hear from you.