Field notes / Selected work
Case studies.
Four field notes from hands-on engineering and isolated labs. The decisions, the checks, and what the evidence actually supports.
All case studies
Endpoint security
Endpoint hardening, validated.
Testing application-control behavior instead of treating a deployed policy as proof of protection.
Threat investigation
An alert is a starting point.
Using file evidence, process context and security telemetry to make a defensible assessment.
Infrastructure security
A service that starts is only step one.
Diagnosing a container permission issue while keeping authentication listeners inside a deliberate boundary.
Controlled security research
Reproduce. Observe. Question.
Learning what a reproducible crash proves, and what it does not, through isolated debugger work.
Technical examples are reconstructed for publication. No private systems or client data.Four case studies. One evidence-first approach.