I'm an offensive security engineer who does pentesting and occasionally digs into evasion research. My work covers web, network, and Active Directory environments — the kind of stuff that comes up regularly on engagements.

I've run dozens of internal and external network penetration tests and web application assessments across a wide range of industries — international airports, regional and international financial institutions, healthcare organizations, and Division 1 universities.

Certifications: OSCP CRTO CRTP MCRTP

Lately I'm most interested in Windows post-exploitation, hybrid (on-prem/Entra) attack paths, and malwareless red teaming — using native tooling and legitimate software instead of custom implants. This site is where I write up things I find interesting along the way: techniques I've come across during testing, evasion concepts worth documenting, and anything else that seems worth sharing.