Security Engineer · London, UK
5+ years securing multi-cloud environments (AWS, Azure, GCP), enterprise networks, and AI systems. CCNA & CCNP-level network engineering. Windows & Linux systems administration. Web application penetration testing. Incident response. From Cisco and Palo Alto firewall architecture to securing LLM pipelines and AI agents — I cover the full stack.
I am a Cloud, Network & AI Security Engineer with 5+ years of hands-on experience protecting enterprise infrastructure across AWS, Azure, and GCP — and a deep foundation in network engineering built from the ground up: routing protocols, switching, firewalls, and network architecture using Cisco and Palo Alto technologies.
My expertise spans the full security spectrum — from architecting Zero Trust networks and securing Kubernetes workloads, to conducting web application penetration tests and building defences against emerging AI threats including prompt injection, LLM data poisoning, and AI agent compromise.
I hold CCNA and CCNP-level knowledge in routing and switching, network security, and firewall architecture — complemented by 15+ certifications across cloud, ethical hacking, forensics, and compliance.
Design and deploy a production-grade SIEM environment capable of detecting lateral movement, credential theft, command-and-control activity, and cloud-based attacks — with automated response playbooks that reduce mean time to respond (MTTR) from hours to minutes.
// Detect multiple failed sign-ins followed by a success — Credential Stuffing let failureThreshold = 10; let timeWindow = 30m; SigninLogs | where ResultType != "0" | summarize FailureCount = count(), FailedIPs = make_set(IPAddress), Apps = make_set(AppDisplayName) by UserPrincipalName, bin(TimeGenerated, timeWindow) | where FailureCount >= failureThreshold | join kind=inner ( SigninLogs | where ResultType == "0" | project UserPrincipalName, SuccessTime = TimeGenerated, SuccessIP = IPAddress ) on UserPrincipalName | where SuccessTime between (TimeGenerated .. TimeGenerated + timeWindow) | project UserPrincipalName, FailureCount, FailedIPs, SuccessIP, SuccessTime
// Detect PsExec lateral movement — remote service creation SecurityEvent | where EventID == 7045 // New service installed | where ServiceName matches regex @"PSEXESVC|[a-zA-Z]{6,8}" | where ServiceFileName has_any ("%systemroot%\PSEXESVC.exe", "\\127.0.0.1\", "admin$") | join kind=leftouter ( SecurityEvent | where EventID == 4624 and LogonType == 3 | project Computer, LogonTime = TimeGenerated, SourceIP = IpAddress, Account ) on Computer | where LogonTime between (TimeGenerated - 5m .. TimeGenerated + 2m) | project TimeGenerated, Computer, ServiceName, SourceIP, Account | extend MitreAttack = "T1570 - Lateral Tool Transfer"
Build a fully documented enterprise network topology simulating a company with a Head Office (London), two Branch Offices (Manchester, Edinburgh), and a DMZ hosting public-facing services — with full routing, switching, firewall, VPN, and security controls implemented end-to-end.
! Hub Router — HO London — DMVPN Phase 3 Config interface Tunnel0 ip address 10.100.0.1 255.255.255.0 ip nhrp network-id 100 ip nhrp map multicast dynamic ip nhrp redirect ! Phase 3 — enables spoke-to-spoke shortcut tunnel source GigabitEthernet0/0 tunnel mode gre multipoint tunnel key 100 tunnel protection ipsec profile DMVPN_PROFILE ! crypto ikev2 proposal IKEv2_PROP encryption aes-cbc-256 integrity sha512 group 20 ! ECDH 384-bit crypto ipsec transform-set TSET esp-aes 256 esp-sha512-hmac mode transport ! Transport mode over GRE tunnel
Leading cloud security and DevSecOps across AWS, Azure, and GCP. Responsible for securing the entire technology estate — from cloud workloads and container environments to CI/CD pipelines, network perimeters, and endpoint fleets. Reduced incident response time by 40% and pre-deployment critical vulnerabilities by 95%.
Supporting 24/7 SOC operations and client security engineering across 150+ UK clients spanning retail, healthcare, legal, and finance sectors.
Providing strategic and operational security support to a consultancy serving journalists, activists, and NGOs — environments with elevated threat profiles requiring practical, risk-proportionate controls.
Conducting vulnerability assessments and web application penetration tests for clients across financial services, healthcare, and e-commerce.
Enterprise security monitoring and incident response for large-scale client environments. The foundation — where I learned how systems truly break, how attackers operate, and how networks actually behave under pressure.
Demonstrated the five phases of incident response — Preparation, Identification, Containment, Eradication, and Recovery — using AlienVault USM, VirusTotal, and Threat Miner. Produced a comprehensive end-to-end forensic analysis of a simulated multi-stage security incident, mapping findings to MITRE ATT&CK TTPs.
A comprehensive record of every technology domain, protocol, tool, and concept I have studied in depth — from ground-up network engineering with Cisco and Palo Alto, to Linux systems administration, VPN architectures, and firewall platforms.
As autonomous AI agents proliferate across enterprise environments, attackers are learning to exploit them. Here's what the threat looks like and how to defend against it.
Read articleA practical walkthrough of implementing micro-segmentation using Palo Alto security policies, App-ID, and User-ID to enforce least-privilege at the network layer.
Read articleInsecure Direct Object Reference remains one of the most commonly missed and highest-impact vulnerabilities I find on engagements. Here's how to find them — and fix them.
Read articleOpen to cloud security roles, network security positions, AI security consultancy, and penetration testing engagements. Let's talk.
A rare combination of deep network engineering knowledge, cloud security expertise, AI threat awareness, and practical offensive security experience — all in one hire.