I work at the Cybersecurity and Infrastructure Security Agency (CISA) as a Senior Data Architect, leading data management for its Cybersecurity Division. I defined the agency-wide tagging and metadata practices, developed a data model built around a handful of domains as a practical alternative to an enterprise model of hundreds of classes, and architected the production rollout of the Open Cybersecurity Schema Framework (OCSF), which now normalizes more than 100 telemetry feeds from federal agencies into a common schema.
Just as much of the work is cultural: getting teams to build on shared, curated data instead of raw feeds, so an analytic written once can run across many sources and be reused by other teams.
I started out in the U.S. Marine Corps, maintaining a base network for 35,000 users. A federal Scholarship for Service took me through an M.S. in Information Security at Purdue's CERIAS and on to US-CERT, where I led the malware analysis team, before I served as a Duty Officer in the White House Situation Room at the National Security Council.
Back at DHS, I designed and built the malware triage and reporting platform. It cut the time to first findings from days to minutes and stayed in use for more than a decade. Later, I led a DevOps team building tools for threat hunting, before moving into data architecture.
The common thread has been giving security data structure, from US-CERT's first machine-readable malware reports to the data models I work on today. Semantic models and knowledge graphs are the next step: an explicit map of security entities and how they relate, which analysts and AI systems alike can reason over.