Blue teamer with a red team brain and GRC trauma

I'm Az. A cyber security analyst focused on blue team operations, threat detection, and security engineering.

I spend my days triaging alerts, hunting threats, and writing detection logic so others don't have to.

I’ve got a background in penetration testing and GRC, which means I think like an attacker and suffer like a compliance officer. That mix helps me build security that actually sticks.

Hands-on with Defender XDR, Sentinel, KQL, and a pile of cloud-native tooling. I blend analyst instinct with engineering execution.

Based in Sydney, Australia. Open to collabs, niche side quests, or mutual rants about false positives.

I don't do "passionate about cyber." I do tired, caffeinated, and relentlessly curious.

Security engineer by day. Digital exorcist by necessity.

I cause less panic. Usually.

🔍 Threat Detection & Response

I swim in logs, chase weird behaviour, and triage alerts before someone else panics.
If it smells like an incident, I’m already elbows-deep in it.

🛠️ Detection Engineering

I build detections that actually work. No eternal loop of "maybe it's a printer."
If it false-positives too much, it goes to the Shadow Realm (aka /dev/null).

📊 KQL & Analytics

I wrangle Microsoft's weird data formats into dashboards that tell stories.
Sometimes I even understand them before my coffee kicks in.

🧠 Red Team Thinking

Ex-pentester. Still have the mindset, but now I build the walls instead of breaking them.
I think like an attacker so others don’t have to.

📎 GRC Trauma (Now Weaponised)

Yes, I know what ISO 27001 is. No, I don’t like it either.
But it means I build detections and processes that make sense and won’t get you audit-slapped.

☁️ Cloud-Native Security

Azure? Sentinel? Defender XDR? I’m already logged in.
If it runs in the cloud and spits logs, I can tame it.

🗣️ Translating Tech to Humans

I’ve explained zero-days to execs without using the words “buffer overflow.”
If you need cyber translated from gremlin to human - that’s me.


I'm not a "jack of all trades".

I'm just the person they call when the alerts won’t stop, the dashboard’s on fire,
and the intern’s script triggered twelve alerts and one existential crisis.

Prefer encrypted carrier pigeons? Ask.