Dedicated security engagements · 2011–2022
Four-plus years, six engagements
Roles where security was the job, not a duty attached to something else. Security work embedded in my IT management and systems engineering roles is listed separately below.
Cybersecurity Engineer
NetForward Corp.Racine, WI
- Authored a Zero Trust Architecture migration assessment for moving restricted, client-compartmentalized data and assets — evaluated candidate solutions by risk and recommended a phased, one-business-process-at-a-time path grounded in NIST SP 800-207, 800-160, and 800-37. See the reconstructed brief — not the original client file.
- Specified the ZTA control baseline: MFA everywhere, managed and health-validated devices, pervasive telemetry, enforced least privilege — scoped to solutions that interface with existing components rather than requiring rip-and-replace.
- Diagnosed a support ticket backlog and designed the remediation: a triage team, a priority classification system, daily triage at stand-up, weekly active-ticket review, and a two-week process retrospective, with KPIs built on Autotask dashboards.
- Implemented security controls protecting corporate networks and data assets.
- Ran vulnerability assessments on corporate systems and wrote up what to fix first. Not a billed penetration test, and I will not list it as one.
Security Consultant Contract
Monitoring Alarm ServicesMilwaukee, WI
- Responded to an active ransomware incident in a mid-size environment and designed the remediation and recovery plan.
- Performed impact and risk assessment to establish the real scope of mitigation before committing to a rebuild path.
- Implemented Azure AD (now Microsoft Entra ID), cloud backup, MFA, MDM, asset tracking, and workstation imaging as the post-incident hardening.
Infrastructure Security Engineer Contract
TEKsystems (Answerport)Mequon, WI
- Designed and implemented security and infrastructure monitoring and alerting across an MSP client fleet.
- Handled deployment, configuration, and troubleshooting of Netwrix Auditor across client environments.
- Deployed vulnerability scanners (Tenable.io, Tenable.sc), ran assessments, and wrote remediation plans.
Systems Engineer, SolarWinds Contract
Milwaukee County via TEKsystemsMilwaukee, WI
- Deployed and iteratively tuned SolarWinds across a 10,000+ user county government spanning dozens of sites.
- Designed a tiered monitoring and alerting schema — classified errors and anomalies, then wrote the response plan for each tier.
- Enumerated infrastructure to surface undocumented and uninventoried resources, including file servers and NAS nobody had on a list.
- Built weekly, monthly, and quarterly KPI reporting for C-level administration.
Security / Systems / Network Engineer
OS IncPewaukee, WI
- Implemented Netwrix Auditor and SCCM to increase visibility and detection across a multidomain environment of 50+ users and 100+ healthcare providers.
- Configured file system operations auditing, Windows account and logon logs, network infrastructure log collection, process detection, and the built-in high-value alert rules.
- Upgraded domain controllers, raised functional level, and rebuilt Active Directory on RBAC principles.
- Ran risk assessments and audits covering Medicare access, internal and vendor security, licensing, HIPAA, and PCI compliance.
- Analyzed phishing email, suspicious files, unusual activity, and indicators of compromise.
- Wrote end-user security training built on emergent threat examples rather than generic awareness slides.
Junior Engineer
Secure Building TechnologiesMilwaukee, WI
- Designed and installed access control and surveillance systems across close to 50 sites for medium and large business environments.
- Produced system layout specifications and implementation plans, then executed client-specific configuration, infrastructure installation, and legacy decommissioning.
- Performed physical security audits covering coverage areas, vulnerabilities, access security, and response time.
- Programmed alarm panels and access control lists, and configured alarm triggering logic.
- Pulled DVR footage and access control system logs to support incident response and investigations.
- Built custom stand-alone network DVRs; supported specialized surveillance installs for authorized public-sector clients.
Evidence
The 2022 recommendation — reconstructed, not the original file
I wrote a Zero Trust migration assessment at NetForward in 2022 for restricted, client-compartmentalized data. I do not have a publishable copy of that document. What follows is a sanitized reconstruction of the reasoning I still stand behind: the question, the constraints, the four testable conditions. It is not the client PDF, and there is nothing to download.
▪The question
How to migrate restricted, client-compartmentalized data and assets against stated requirements. Not “is Zero Trust good” — which solution carries the least risk under these constraints.
▪The recommendation
Migrate toward Zero Trust: eliminate implicit trust and continuously validate every stage of a digital interaction, protecting resources rather than network segments.
▪The required behaviors
Identities validated with MFA everywhere · devices managed and validated healthy · telemetry pervasive · least-privilege access enforced. Four testable conditions, not a posture statement.
▪The constraint that makes it real
Migrate one business process at a time, and restrict candidate solutions to those that interface with existing components. A recommendation that requires rip-and-replace is a recommendation nobody executes.
▪The basis
NIST SP 800-207 (Zero Trust Architecture) · SP 800-160v1 (systems security engineering) · SP 800-37 (risk management framework) · GSA Zero Trust buyer’s guide.
Reconstructed August 2026 from the NetForward engagement. Client, environment, and asset detail omitted. If you need the original file, I cannot produce it.
Capability matrix
Every claim, and where it was earned
Filter by what you’re hiring for. Each capability links to the engagement that proves it — and the ones I don’t have are listed too, in the same table, marked in red. You should be able to staff a rotation off this, not just check boxes on a req.
▪Netwrix Auditor
OS Inc — implemented Netwrix Auditor and SCCM across a multidomain healthcare environment. Configured file system operations auditing, Windows account and logon logs, network infrastructure log collection, process detection, and built-in high-value alert rules. Also deployed and administered at ITS across client AD and file servers, and at TEKsystems (Answerport) across MSP client fleets.
▪Active Directory
OS Inc — upgraded domain controllers, raised functional level, rebuilt AD on RBAC principles. Construction Forms — built and maintained AD structure, security and distribution groups. Plus AD red teaming and a Windows Server home lab.
▪Entra ID (Azure AD)
Monitoring Alarm Services — implemented Azure AD alongside MFA, MDM, cloud backup, and asset tracking during ransomware recovery. Microsoft renamed Azure AD to Entra ID in 2023; same directory service.
▪Zero Trust architecture
NetForward — authored the migration assessment for restricted, client-compartmentalized data: eliminate implicit trust, validate every stage continuously, protect the resource rather than the network segment. Specified four testable conditions — MFA everywhere, devices managed and validated healthy, telemetry pervasive, least privilege enforced — phased one business process at a time, per NIST SP 800-207, 800-160v1, and 800-37. See the reconstructed brief — not the original client file.
▪NTFS & share permissions
Construction Forms, Milwaukee County — mapped and documented file system and network resource access rights, then remediated excessive permissions. Least-privilege enforced through individualized, auditable service accounts.
▪NAS & storage auditing
Construction Forms — designed and managed a fiber-backed NAS as part of a $70K overhaul with HA clustering, network RAID, and SSD tiering. Milwaukee County — enumerated undocumented file servers and NAS during infrastructure discovery.
▪Monitoring & log alerting
Milwaukee County — deployed SolarWinds from scratch across a 10,000+ user government, built a tiered alerting schema, classified anomalies, and wrote the response plan for each tier so the on-call had an action, not a red light. Tuned to suppress noise rather than to look busy.
▪Incident response
Monitoring Alarm Services — responded to an active ransomware incident and designed the remediation and recovery plan. OS Inc — phishing analysis, suspicious file triage, indicator-of-compromise identification. Root cause analysis and pivot methodology as standard practice.
▪Malware & packet analysis
Riverwest Computer Repair — built malware sandboxes logging file system and registry modification, identified propagation vectors, tested AV detection. Packet analysis to characterize infections and anomalous traffic.
▪HIPAA & PCI-DSS
OS Inc — risk assessments and audits covering Medicare access, vendor security, licensing, HIPAA, and PCI compliance in a healthcare billing operation. Production environments, not tabletop exercises.
▪Physical security auditing
Secure Building Technologies — physical security audits across close to 50 sites covering coverage areas, vulnerabilities, access security, and response time. Pulled DVR footage and access-control logs for investigations.
▪PowerShell & scripting
Automation, data collection, and remediation. Bash and PXE automation at ITS cut technician time-per-machine by 70%; standardization cut hands-on time to resolution by 61%.
▪SQL Server & ERP
Construction Forms — administered SQL Server and ERP databases, writing custom queries against production to modify and extract data. Led the contracted dev team building the manufacturing ERP and its integration with a partner system.
▪Access Analyzer (StealthAUDIT)
Haven't run the console. Same vendor, though — Netwrix merged with Stealthbits in 2021, and StealthAUDIT is now Netwrix Access Analyzer. I've done the job it does by hand and with Auditor: mapped effective NTFS and share permissions across file servers and NAS, documented who had access to what, and drove remediation of excessive rights at Construction Forms and Milwaukee County. The tool is new to me; the workflow isn't.
▪GDPR
Familiar as a framework. Never operated under it — my regulated work has been HIPAA and PCI-DSS.
▪ green = evidenced above · ▪ red = gap, stated plainly
Infrastructure, consulting, and the years after 2022
Where the security instincts came from
Flextech is first because it is the most recent stretch of full-time work. The 2005–2017 IT jobs are under it, newest first. Viktech stays last — it never ended.
Founder / Chief Technical Officer
Flextech Design LLCShorewood, WI
- Founded an on-demand micro-manufacturing consultancy; designed the concept-to-fulfillment value stream end to end.
- Prototyped manufacturing process monitoring and automation — the same telemetry-and-alerting instinct applied to physical production.
Earlier IT leadership · 2005–2017
IT Manager / Systems Administrator
Construction FormsPort Washington, WI
- Sole IT employee for an international multisite manufacturer — 150+ employees across the US, Wales, and Germany.
- Administered SQL Server and ERP databases, writing custom queries against production to modify and extract data.
- Led a contracted development team building the manufacturing ERP and its integration with a partner ERP team.
- Specified and delivered a $70K network and server overhaul: HA clustering, network RAID, SSD tiering, fiber backbone, redundant distribution.
- Built AD structure and security groups; audited file and share permissions and remediated excessive access; implemented WSUS to standardize patching.
Senior Systems Engineer / Managing Technician
Integrated Technology SolutionsMilwaukee, WI
- Cut technician hands-on time to resolution 61% through standardization and automation; cut time-per-machine 70% via diagnostic automation.
- Deployed and administered Netwrix Auditor across client Active Directory and file server environments for change and access auditing.
- Designed and maintained access control, surveillance, alarm, and POS solutions for medical, manufacturing, government, and enterprise clients.
- Built a custom networking schema isolating infected client machines and segregating IT resources from customer wireless.
- Configured RADIUS authentication and managed client access through a VISP portal.
Technical Sales Manager
National Broadband (NB Tech)Milwaukee, WI
- Performed physical, data, and network security audits; designed credential storage policy.
- Reviewed and responded to monitoring and scanning alerts, recommending and implementing mitigations.
Systems Engineer Contract
Manage-PointWauwatosa, WI
- Configured 30+ workstations across 7 business infrastructure deployments; resolved 40+ tickets remote and on-site.
Managing Technician
Riverwest Computer RepairMilwaukee, WI
- Built malware test environments logging file system and registry modification, identifying propagation vectors, and testing AV detection.
- Performed packet analysis of infected machines to characterize infections and anomalous traffic.
- Deployed PXE and NAS to centralize resources and automate diagnostics via boot images and scripts.
QA Tester
Medical College of WisconsinMilwaukee, WI
- Verified correct enabling and disabling of features and permissions by user account access level — access control testing before I knew that was the name for it.
- Tested input validation and verification; documented and reported bugs and unhandled errors.
Owner / IT Consultant
ViktechMilwaukee, WI
- Resolved incidents involving data loss, equipment failure, security breaches, and unauthorized disclosure.
- Designed and implemented backup, failover, recovery, and secure destruction.
- Repaired 400+ computers for 150+ home and small-business customers.
Credentials & currency
Stated exactly as they are
Including the ones that lapsed and the coursework that never became a certificate. If a credential isn't current, it says so here before you have to ask.
Six Sigma Green Belt Current
Process capability, root cause analysis, and measurement discipline — the same habits that make an audit finding defensible.
CISSP Lapsed · retaking Q4 2026
2019 – 2025
Passed twice. Lapsed in 2025 and I'm sitting the exam again rather than claiming a credential I don't currently hold.
Information Security Specialist — coursework completed, no degree
Milwaukee Area Technical College · Information Security and Digital Forensics · 2018 – 2022
MS Server Administration I & II · Cisco I & II · Unix/Linux Administration and Security · Security Policies and Procedures · Router and Perimeter Security · Securing Wireless Devices and Networks · Computer Forensics · Malware Forensics. Includes CompTIA A+, Network+, and Security+ exam prep — exams not taken, certifications not held.
Manufacturing Technology — program completed
IESI Institute, Milwaukee, WI · September – December 2024
CNC mill and lathe operation · G-code and M-code · blueprint and technical drawing interpretation · precision measurement with calipers, micrometers, and gauges.
Computer Science — coursework completed, no degree
University of Wisconsin–Milwaukee · 2007 – 2011
Data Structures & Algorithms · Discrete Information Structures · Operating Systems · Formal Logic · Intermediate Programming (C++).
Lab & builds
- Home lab — Active Directory red teaming, Windows Server, virtualization on a 24-core Threadripper; QNAP NAS for archival
- HACCP cooler monitor — commercial walk-in: ESP32 Feather V2, DS18B20 sensors, MING stack on a Raspberry Pi 5, multi-channel alerting. Built at Milwaukee Makerspace.
Security community
- HackThisSite CTF team — active competition2017 – Present
- DEFCON 414 — Milwaukee DEFCON group
- CyberShield MKE — building small-business security consulting; wrote the Hacking Happy Hour workshop curriculum, starting with evil-twin Wi-Fi attacks
The Great Lakes
Everything that isn’t a security title
My career doesn’t read like a straight line, and I’ve stopped apologizing for that. I started Viktech in 2005 fixing computers out of my apartment and never closed it. Along the way I ran IT alone for a manufacturer with plants on two continents, built a wireless ISP backbone, founded a micro-manufacturing consultancy, retrained on CNC mills and lathes at IESI, and spent a stretch running kitchens — including six months making naturally fermented sourdough at 750°F under a Michelin-trained chef. None of that was a detour from the technical work. Every one of those jobs was the same problem in different clothing: figure out how the system actually behaves, find where it fails, and build something that holds.
What that breadth actually bought me is a specific kind of usefulness. I’m the person who reads the whole environment before touching anything. Running IT solo for 150 people across the US, Wales, and Germany meant there was nobody to escalate to — I learned to enumerate first and act second, which is the same instinct that makes a permissions audit worth doing. Kitchens taught me throughput under real time pressure and that a quality checkpoint you skip once becomes a checkpoint you never do again. Six Sigma gave me the vocabulary for what I’d already been doing badly on instinct. And ten-plus years at Milwaukee Makerspace — hardware hacking, ESP32 firmware, FPV, amateur radio, a HACCP monitoring rig for a walk-in cooler — is where I stay fluent in the layer underneath the abstractions, which matters more in security than most job descriptions admit.
I’m broader than I am specialized. Someone who spent eight years on nothing but identity governance will out-depth me on their own tool. What I bring instead is that I’ve been the sysadmin, the engineer, the manager, and the person on the other end of a 2 a.m. ransomware call — so I understand why the excessive permissions got granted in the first place, and what it costs the business to take them back.
Volunteer
- DryHootch — IT training for veterans2010 – 2012
- People’s Books Cooperative — IT services and operations support2008 – 2014
- Riverwest Co-op — store volunteer2010 – 2015
- St Benedict the Moor — food pantry2016 – 2020
- Riverkeepers Alliance — river cleanup2018 – 2020
- Adventure Rock — strength coach and climbing instructor2020 – 2023
Milwaukee Makerspace — member since 2013
- Built a modular smart tablecloth LED panel system — WS2812B addressables, ESP32, WLED firmware — for convention demos
- Ran for the Board of Directors; governance, member dispute resolution, organizational accountability
- The person who walks newcomers through the tools and safety procedures, ten years running
Hands-on interests
- Computers — I hang out in the log files anyway
- Hardware hacking — ESP32 firmware, WLED, addressable LED rigs, 3D printing
- High-powered electric scooters — my primary transportation, plus the controller tuning, battery care, and brake work that keeps one alive through a Milwaukee winter
- FPV drones — flying and building; DJI FPV and Mini series
- Amateur radio — licensed operator. Pulling a signal out of noise is the same problem as log filtering, just with worse tooling
- Culinary art — deep rich flavors. Long ferments, stocks reduced past the point of reason, and heat used deliberately
- Music production — drum and bass and hip-hop; writing and performing an album
- Fountain pens, hammock camping, live music, and the Great Lakes — what I do away from a keyboard
Contact
Available now
Remote or on-site in southeastern Wisconsin. US citizen — no sponsorship required.