Cybersecurity @ UTSA
Detection engineering on a cloud security foundation.
Fresh off an incident detection & response internship at Marathon Petroleum — EDR triage, SOAR playbooks, threat intel, and OT monitoring — and building a library of platform-agnostic Sigma detections mapped to MITRE ATT&CK. Graduating December 2026.
Every entry below is real, dated, and verifiable — cloud foundations first, then cloud security, then the SOC, now detections.
Earned AWS Cloud Practitioner, Microsoft AZ-900, and the Google Cybersecurity Certificate. Built core skills in Azure, AWS, networking, and Python.
Implemented an AWS SIEM pipeline forwarding GuardDuty findings through S3 into OpenSearch for real-time analysis, dashboards, and high-severity alerting.
Owned alerts end-to-end in a flat SOC: triage in CrowdStrike Falcon and Microsoft Defender, SOAR playbooks in Google SecOps, threat intel enrichment, and OT monitoring in Dragos.
Writing platform-agnostic Sigma rules mapped to MITRE ATT&CK, each documented with detection logic, expected false positives, and tuning notes. Working toward AZ-104.
Graduating from UTSA in December 2026 (BBA Cybersecurity, 3.72 GPA). Targeting detection engineering and SOC roles where I can keep shipping detections.
An early-stage, growing library of platform-agnostic Sigma rules mapped to MITRE ATT&CK. One rule converts to KQL (Sentinel), SPL (Splunk), or YARA-L (Google SecOps). The point isn't collecting rules — it's demonstrating detection thinking: technique → log source → logic → fidelity and tuning. Every rule that lands here is fully documented before the next one starts.
| Detection | Tactic | Technique | Log source |
|---|---|---|---|
| Windows Security event log cleared | Defense Impairment | T1685.005 | Windows Security (1102) |
| Shadow copy deletion via vssadmin | Impact | T1490 | Windows process creation |
Each rule ships with a write-up covering detection logic, expected false positives, and tuning notes.
Detections are only as good as your understanding of the environment they run in. These builds are the cloud foundation underneath the security work.
Cloud-native SIEM built during my Trevenx internship — GuardDuty findings forwarded through S3 and Firehose into OpenSearch for centralized log analysis, real-time dashboards, and high-severity alert triggers. Lives under the Trevenx org.
14 documented labs across the full AZ-104 surface — identity, governance, networking, storage, compute, containers, data protection, and monitoring. Each lab is written up as its own report; browse the index below.
AZ-104 lab index — 14 write-ups
Marathon Petroleum
Trevenx
Allegiance Mobile Health
Detection & response
Cloud & identity
Automation & analysis
Frameworks & process
Open to Fall 2026 internships and entry-level detection engineering or SOC roles. The fastest way to reach me is email or LinkedIn.