I build LLM agents that research, write, and tune detections, and I treat what they can reach as attack surface. 13+ years at Bloomberg, from the service desk to detection-as-code.
I joined Bloomberg in 2012 on the service desk and moved through security architecture, threat hunting, and incident response into detection engineering, so I write detections with a working memory of how alerts get triaged, escalated, and investigated.
Much of my work now goes into LLM agents for the detection lifecycle. My view: an agent should run as a least-privilege identity, see no more sensitive data than its task needs, and earn trust only when its output holds up against live data.
13+yrsat Bloomberg, across five roles
3.5h/dayaverage team tuning time saved by the agent
67CI-tested Sigma rules in det-eng
25ATT&CK technique IDs in det-eng
Experience
Bloomberg L.P.2012 to present
Senior Detection Engineer
Detection Engineering, Princeton, NJ (hybrid)
Conceived and built an LLM-powered detection tuning agent, from MCP tools to prompts and tests, now in production use. It validates its suggested changes against live Splunk and LogScale data, saves the team an average of 3.5 hours per day, and has inspired a teammate's assistant for other detection workflows.
Engineered guardrails that limit the agent's exposure to sensitive data: a data abstraction layer that restricts what the model can query, a token vault, and a secret sanitizer.
Built an agentic detection engineering environment from connectors, reusable skills, and an LLM coding agent that orchestrates subagents for research, detection writing, and false-positive analysis.
Brought the first detections on an endpoint sensor's network telemetry from evaluation to deployment in hours, using AI assistance; comparable work took three months in 2025.
Drive the team's AI adoption, including drafting guidance on appropriate AI use for the team and the wider security operations organization; mentor detection engineers and other security colleagues.
Own the team's threat research, detection research, and process improvement; delivered same-day detection for a newly disclosed CVE, TTP analysis for a zero-day, and audit-log detection coverage for a cloud AI service.
Turned a data source migration into a full macOS detection review, reworking the 20% found ineffective or stale.
Maintain a large dual-SIEM detection library; found a query filtering pattern that could return unintended results and corrected every affected rule.
Ran scoping hunts that became key to concluding an incident investigation.
Senior Analyst
Cyber Incident Response Team, New York City metro area (hybrid)
Owned detection research and library maintenance: tuning, enhancing, and pruning rules.
Led and supported digital forensics and incident response on escalations from triage and threat hunting.
Partnered with engineering to stand up S3-compatible forensic storage, simplifying incident evidence collection.
Onboarded an ITDR platform, extending identity-based threat detection.
Wrote a Python tool that uses VirusTotal to flag malicious hashes in the in-house threat intelligence platform and to pull IoCs by threat actor or other criteria.
Integrated a new EDR's alerts into the SIEM, tuned its initial detections, and selected training for SOC teams.
Threat Hunting and Intelligence Analyst
New York City metro area
Hunted for threats, responded to incidents and alert escalations, and tested new detection rules and alerts.
Security Analyst / Architect
Security Architecture and Engineering, New York City metro area
Secured the corporate LAN: investigated nonstandard access requests, responded to nonstandard changes, audited controls, and reviewed new systems and devices.
Identified coverage gaps, then designed and built controls to close them; found vulnerabilities in systems and applications and drove remediation with owners.
Authored security procedures so infrastructure and operations teams built and ran new systems to policy.
Personal experiment in detection at scale: an LLM agent researches techniques, emulates attacks, and writes Sigma rules across Linux, Kubernetes, AWS, Azure, and GCP; I pick each technique and merge only what passes CI. It holds 69 experimental rules (67 tested in CI) across 25 ATT&CK techniques and sub-techniques, and 27 technique research reports. Each tested rule must fire on its own safe emulation (sample logs for cloud) and not on near-miss variants or a benign baseline.
Merged fix to Sigma, the open standard for vendor-agnostic detection rules: tightened the Windows Ping Hex IP rule to require a hex-encoded IPv4 address (0x plus eight hex digits), not just any 0x in the ping command line.
Certifications and training
GPENGIAC Penetration TesterSEC560 · held 2018 to 2022
GCUXGIAC Certified UNIX Security AdministratorSEC506 · held 2017 to 2021
GCCCGIAC Critical Controls CertificationSEC566 · held 2017 to 2021
SANS training
FOR608Enterprise-Class Incident Response and Threat Hunting
SEC401Security Essentials
SEC503Network Monitoring and Threat Detection In-Depth
SEC505Securing Windows and PowerShell Automation
SEC506Securing Linux/Unix
SEC545GenAI and LLM Application Security
SEC560Network Penetration Testing and Ethical Hacking
SEC566Implementing and Auditing the Critical Security Controls
SEC579Virtualization and Cloud Security
SEC660Advanced Penetration Testing, Exploit Development, and Ethical Hacking
SEC760Advanced Exploit Development for Penetration Testers
