I want a career in security, not a certificate that says I tried. Right now I'm building toward it inside a Fortune 50 bank's production environment, with real access, real incidents, real consequences when I'm wrong. Everything past this paragraph is what I built in the hours nobody paid me for.
For the past four years I've worked inside Wells Fargo's production environment, currently as an Application Support Engineer (L1.5), on a 24/7, follow-the-sun team responsible for 900+ consumer- and bank-facing applications.
I hold privileged access to production systems where mistakes carry real financial and regulatory weight. I help drive live deployment calls, and I coordinate with Major Incident Management across time zones when something breaks and can't wait until morning. It's taught me things I don't think I could have learned any other way, how a large, regulated organization actually behaves under pressure, what a runbook needs to hold up when it's tested for real, and how much good incident response depends on staying calm and communicating clearly, not just knowing the fix.
Alongside that, I've been teaching myself security in whatever hours I can find, because I genuinely enjoy it, detection engineering, threat intelligence, identity security. I'm still early. I know it. This page is the evidence that the curiosity is real and durable, not something I put on for an application.
Mapped the group's full attack lifecycle to MITRE ATT&CK, synthesizing intelligence from Microsoft, Mandiant, and CrowdStrike. Developed defender-focused investigation workflows for identity compromise and proposed hardening controls including phishing-resistant MFA, Conditional Access, and Tier-0 protection.
37-page technical analysis of the group's TTPs, attack lifecycle, and credential theft techniques, with mapped detection opportunities.
End-to-end pipeline simulating ATT&CK techniques, ingesting Sysmon telemetry, and operationalizing validated KQL detections as Sentinel Analytics Rules.
Emulated adversary techniques, correlated Windows telemetry to ATT&CK tactics, and produced structured detection reports.
Built detection use cases for process execution, account creation, and PowerShell abuse; documented telemetry gaps.
Implemented Joiner-Mover-Leaver lifecycle processes and RBAC; validated least-privilege access and generated audit evidence.
Breach-intelligence assessment evaluating authentication posture, MFA readiness, and identity attack surface.
I started working at seventeen, and by twenty-one I've had the chance to help keep production stable for a Fortune 50 bank. I don't take that for granted, and I'd be grateful for the opportunity to bring that same care, and a willingness to keep learning, to a security team.
I don't say any of this to claim expertise I don't have yet. I say it because it's the clearest evidence I have that this curiosity is real, not something I'm putting on for an application.
from a cover letter I've actually sent