Cybersecurity Analyst, Werner Enterprises
May 2026 – presentFull-time since May 2026. Started on the team as a Cybersecurity Analyst Intern, Aug 2025 – May 2026.
Google SecOps
- Detections. I write YARA-L rules against UDM data. One example: I noticed a service account being renamed and reused in a way that didn't look right, traced the app_add and app_remove events back to the same UUIDs, and wrote rules to catch admins targeting their own accounts and unauthorized username changes.
- Playbooks. I build SOAR playbooks that pull context and take action in other systems through their APIs and webhooks, so analysts don't have to do the same lookups by hand on every case.
Cloud Security Posture Management
- I review cloud posture findings, figure out which ones actually matter, and work with the owners to get misconfigurations fixed.
Incident Response
- I take part in incident response, from the first alert through investigating what happened, scoping what was affected, and containing it.
Day-to-day SOC work
- Triage of user-reported phishing in PhishER, including pulling apart suspicious attachments.
- Responding to DLP alerts.
- Case handling in SecOps SOAR.
Python scripting
- I write Python scripts that work with the Chronicle API, the gcloud API, the Cloudflare API, and others to automate tasks we'd otherwise do by hand.