↓ Skip to main content
Attack the SOC

👋 Hello!
#

I’m Dylan. Husband and dad to a beaufitul family that motivates me to be a better person every single day. I wouldn’t be where I am today nor the man I am today if I didn’t have these people behind me every step of the way.

I’ve spent about a decade in information security, most of it buried in the Microsoft stack - Entra ID, Defender XDR, Sentinel, and more Azure Automation duct tape than I’d care to admit. I have a passion for deeply understanding the technology I’m working with, the TTPs of the attackers I’m investigating, and helping others break into the industry and/or upskill their game to meet their career goals and follow their passion.

Lately I’ve moved toward the messier, more interesting end of the job: DFIR and M365 forensics, reconstructing what actually happened inside a tenant after things go sideways, and being able to prove it. Alongside that I’ve been going deep on AI SOC engineering: wiring LLMs into the repetitive parts of detection and response and threat hunting so analysts can spend their attention on the calls that actually need a human. It’s been interesting to see what parts of our workflows AI can accelerate and which areas still require the human touch.

Most of what I work out ends up here — usually written up after I learned it the hard way.

🌟 Quick Facts
#

  • 📍 Location: USA
  • 🏛 Alignment: Neutral Good
  • 💼 Focus: DFIR & M365 forensics · AI SOC engineering
  • 🎓 Certifications: CompTIA Network+, Security+, CySA+
  • 🍄 Interests: Family, getting lost in nature, woodworking/whittling projects, home diy doomscrolling

🌟 What I Work On
#

The things I reach for most:

  • DFIR & M365/Entra forensics — unified audit log, mailbox and sign-in forensics, tenant-compromise investigations
  • Threat hunting & detection engineering in KQL across Defender XDR & Sentinel
  • AI in the SOC — LLM-driven triage, investigation pivots, and report writing
  • Azure Automation (Logic Apps, Runbooks, Functions) for response and the boring glue work
  • Defender suite management (MDE, MDCA, MDI, MDO)
  • Identity — Conditional Access, user lifecycle, SSO & provisioning

🌐 Online Presence
#

Find me online:

🎯 Hobbies
#

When I’m not working, you’ll find me:

  • Reading (Horror, Philosophy, Non-fiction on Geopolitics, intelligence and espionage)
  • Wood carving
  • Writing short stories
  • Butchering a few chords on the guitar

📫 Get in Touch
#

I’d love to hear from you — reach out any time:

“The only thing in our control is our own thoughts.” — Epictetus