Government Cyber Coordination Centre (GC3) · Contract · Hybrid

• Lead detection for a UK government programme set out in the Government Cyber Action Plan.
• Build custom AI pipelines that ingest vulnerability and CTI data from multiple sources, normalise it, and generate detections across several query languages.
• Built strict validation processes for detection content, testing detections at scale against true-positive logs in multiple SIEM languages.
• Further programme work is not publicly disclosable.

Foreign, Commonwealth and Development Office · Contract

• Built the department's detection-as-code platform, including its CI/CD pipeline.
• Built detections protecting critical UK government infrastructure.
• Matured the detection engineering function and led upskilling across the team.

Cabinet Office · Contract

• Developed and implemented detection-as-code CI/CD pipelines using Splunk security content, contentctl and a custom Python library.
• Built scalable detection content based on data models.
• Developed SOC KPIs for the detection function and presented them to key stakeholders.
• Drove the SOC maturity journey, implementing change at scale through DLP, architectural change and detective monitoring improvements.
• Mentored junior analysts and upskilled team members.

CyberProof / UST · Full-time

• Led the Middle Europe security monitoring and detection team, mentoring analysts and supporting complex investigations.
• Built a threat hunting platform from scratch on an exclusive contract with a Fortune 100 client.
• Developed tailored threat hunting packages from MITRE TTPs, using a MITRE heatmap I built to expose use-case gaps.
• Hunted advanced in-memory threats using anomaly-based detection and CTI-driven hypotheses across a large network estate.
• Represented the blue team in purple team exercises, building queries to detect techniques designed to bypass industry-leading EDR.
• Performed complex incident response investigations at scale and reported hunting KPIs to stakeholders.

London Stock Exchange Group (LSEG) · Full-time · London Area, United Kingdom

• Monitored and protected highly regulated environments, securing legacy and unpatched infrastructure against advanced attack.
• Developed advanced monitoring for SWIFT payment infrastructure to meet best practice in a highly regulated banking environment.
• Applied threat modelling and a defence-in-depth approach across EDR and network monitoring.
• Proactively hunted anomalous activity and tuned known-good behaviour to surface lateral movement and other ATT&CK TTPs.
• Investigated breaches end to end: timeline reconstruction, remediation, reporting and stakeholder communication.

Reliance ACSN · Full-time

• Investigated alerts daily, delivered tuning recommendations and built new detection rules.
• Advised customers on enforcing security policy through technical controls.
• Worked to PCI-DSS, ISO 27001 and NIST 800-63 from a security compliance perspective.