Security operations · Instructor

Learn how to build defenses that hold under pressure.

I lead security operations at Black Hills Information Security, teach SOC and SIEM courses through Antisyphon Training, and run Noct InfoSec for independent projects and content.

Black Hills Information Security Noct Information Security Antisyphon Training
What I do Projects
About

Nearly a decade in the SOC.

Operations, incident response, detection engineering, automation, and teaching — usually all at once.

I spend most of my time at Black Hills on the things that matter when alerts start stacking: detection quality, investigation workflows, and the operational habits that keep a team from drowning in noise. The goal is always fewer false positives, faster triage, and systems that analysts actually trust.

Through Antisyphon and Noct, I teach and package that same work: SIEM engineering, alert triage, and detection logic for defenders trying to build durable capability instead of checking compliance boxes.

Focus

Where the work happens.

BHIS Security operations leadership

Running detections, investigations, and analyst workflows, focused on signal quality over dashboard volume.

 Antisyphon Training SOC and SIEM instruction

Teaching detection engineering, alert triage, and the practical mechanics of running a SOC that works.

 Consulting Noct Information Security

Courses, private team workshops, tooling, and independent content.
Projects

Things I've shipped.

Course Foundations of Security Operations

16-hour course through Antisyphon Training. Students build a functioning SOC, learn SIEM and ticketing, and write custom detections from scratch.

View course → Workshop SOC Detection Engineering Crash Course

Hands-on workshop: build a detection engineering lab, ingest logs, research adversary techniques, and validate rules through live attack simulations.

View workshop → GitHub Raycast for InfoSec

Raycast extensions for common infosec workflows, fewer clicks, less context switching.

Open repository → Writing The Formula for Great SOC Tickets

Clear, concise, and comprehensive — a framework for writing tickets analysts can actually act on.

Read on BHIS → Talk The Detection Engineering Process

Walkthrough of the full detection engineering lifecycle, from hypothesis to deployed rule.

Watch →
Connect

Get in touch.

Most active on GitHub and LinkedIn.

Email GitHub LinkedIn X Noct