How I got here
My DFIR career started in Kroll's cyber lab, imaging laptops and phones and learning early that chain of custody isn't optional. That lab work turned into frontline incident response on intrusions, ransomware, IP theft, and business email compromise cases, and I haven't looked back since.
From there I worked incident response at CrowdStrike and KPMG US, sharpening host, network, and memory forensics on complex investigations and leading workstreams for the first time. At Palo Alto Networks Unit 42 I grew from Senior Consultant to Principal Consultant, running large engagements for Global 2000 organizations and briefing executives, legal counsel, and insurers through some of their worst days.
I spent time in-house at Elastic as an incident commander for internal security incidents, which gave me a view of response from the defender's seat. Along the way I've served as a SANS Virtual Teaching Assistant for FOR500 and FOR608.
Today I'm a Director of DFIR Consulting at CYPFER, leading incident response engagements and developing the managers and consultants who run them. DFIR Dominican is where I share what I've learned across 230+ investigations, so the next responder has a clearer path into the field.