TL;DR: I have shifted more to the blue team side of things as I have progressed in my career. Not out of a lack of love of pentesting, but moreso because I am always curious about what I don’t know, and hopping over the fence was an easy way to learn. This has been a great opportunity personally and professionally, and I encourage fellow pentesters to give it consideration.

Estimated Reading Time: 4 minutes

---

Ever since I first discovered hacking in high school, I had wanted to be a pentester.

No other career path or title fit me spiritually. I would go on to get a degree in Computer Forensics, sure, but only because they didn’t have a PhD program in Hacking. I spent nights and weekends doing CTFs, practicing buffer overflows, attending cons, and generally living in the infosec space. When I finally did land my first freelance pentest job, and later got hired on as a full-time pentest consultant, it felt like I had everything I wanted.

But around the four-year mark at Surescripts (c. 2023), roughly six years into my pentesting career, I started to get a bit bored with things. Software at a company like that does not tend to change drastically from one year to the next, so testing the same app lineup year over year became tedious. New apps would be added to our list, and that provided some excitement, but they largely worked on the same data and processes as other apps, so it wasn’t like it was a whole new toy.

So I asked my boss if I could help with the SDLC side of things, advising and mentoring the developers on security matters. He did one better, and handed over the reins to our Security Champions program. I would lead semi-monthly meetings in which the security-minded devs meet and I cover topics ranging from the OWASP Top 10 to secure handling of in-memory data. Leading this program and the resulting goodwill between the Security and Development departments is one of the proudest achievements of my career.

And for a while that kept things fresh and interesting. From there I was invited to monthly meetings with some of the dev managers and architects to do vulnerability code review, improve our SAST program (and later migration), advise and mentor on security best practices, develop guidelines and procedures, and more. Even though it was a different set of mental muscles than pentesting, I found the work rewarding and it taught me a lot about the other side of the fence.

While continuing that work, an opportunity arose to peek over into the Incident Response team. We were in search of a new Director, and my Manager (who was the Acting Director) was out for a week, so for five days I held the distinguished but unofficial title of “Acting Acting Director of Vulnerability and Threat Management“. During that time, I reached out to the various teams under my purview to see if they needed help with anything. Blockers I could work to remove, technical assistance they needed, escalations up the chain.

The Incident Response team ended up being my main focus for that week and for the months to follow. There was a need to clean up the response playbooks, address some bugs in need of squashing in our SOAR platform, implement process improvements, and provide mentorship generally. Given my background in security and automation, I fit the bill nicely. I may do a deeper dive into the process at some point, because I feel there is some value there, but essentially I:

• standardized the human-readable playbooks based off a template and example playbook I wrote
• fixed the high-priority bugs in our SOAR platform, cutting down on manual work and improving their response time
• formalized a Jira workflow to help track and remediate the bugs and feature requests from the team
• provided technical mentorship on everything from attack indicators, to Linux basics, to networking concepts

This process took me away from my pentesting responsibilities somewhat. My boss encouraged this, as the other pentester on my team had by this point been there long enough to handle it on their own for the most part. I could devote more time and expertise to a team that really needed it, and this paid off in the long run. It didn’t hurt that the work was new and interesting as well.

And that’s roughly where I am today. I am still officially on the pentest team, but I spend much of my time more on the blue team side of things. I am overseeing the migration to Google SecOps, which is both an exciting challenge and a shiny new toy. I’ve left behind a trail of closed Jira tickets, with more to come in the backlog. I’m working on formalizing an every-other-week informal training session called a “Lunch and Learn”, something I took with me from my Nagios days and which was hugely successful.

In closing, I’ve always liked the Purple Team concept: Devs and pentesters working together to secure code; IR and redteamers working together to test and improve alerts; Builders and breakers working toward a shared goal. And while I have a solid track record on the red side of things, I’m genuinely enjoying applying that to the blue. The interplay between these two sides of the same coin is one I am excited to see play out and evolve.

My heart will always be firmly rooted among buffer overflows and SQL injections, but the change of pace has been a welcome one and the knowledge and skills gained are valuable. I encourage any pentesters who are reading this to take a peek, even if only briefly, over the fence.

This is the long “story” version. For the shorter “resume” version, see here: My Career

Estimated Reading Time: 11 minutes

---

What follows is the not-short story of how I ended up where I am today. It’s more a themed biography than a resume. Grab a snack.

Middle School

I started programming in the 8th grade, learning BASIC for the TI-83+ calculator. Our math teacher had introduced us to this functionality in order to teach us about functions of some sort, but that lesson was lost on me at the time. I was hooked. I read “Chapter 16 – Programming” without ever having studied programming before. I don’t think I had even seen code before. “Chapter 17 – Activities” had me plotting pixels to form a Sierpiński Triangle. I was making dice-rollers for our D&D group, formula solvers for math tests, and generally doing a disservice to my neck vertebrae by staring down at that screen for hours.

Around that same time I would get my first computer – a Windows XP machine – and a printer to go with it. We had Internet by then, and I passed many nights finding games written in Assembly for the calculator. There was a whole black market back then in our middle school for these games. Block Dude in particular was a hot commodity, and if you were even remotely serious about things you ran Mirage OS (or “Mirage 5” as we thought it was called). I did not end up learning Assembly in those days, mostly because it was a bit advanced for me and we didn’t have nearly the amount of learning resources we do today.

High School

In high school, things really took off. I taught myself perl as my first “real” language, and had a lot of fun using WWW::Mechanize to scrape websites. I enrolled in an elective class covering C++, as well as one that advertised web programming, but which just ended up being HTML and JavaScript (in Dreamweaver…). The C++ class was a highlight of those years – my friend and I made a proper D&D game, or as close to it as we could manage; the class stopped short of teaching functions, so everything was a mess of global variables, and goto statements.

Two other core events occurred in my Freshman year which would shape my career trajectory for the better.

First, I discovered hacking. For the life of me I can’t recall what I was reading, but somehow or other I came to learn about cross-site scripting. Over the next few months I learned about SQL injection, PHP, hex editing, IRC, Phrack, buffer overflows, Samy, exposed directory indexes, electronics, and so much more. I saw Hackers for the first time. My dad took me to my first DefCon conference (DC17).

Second, my Windows XP machine blue screened. I was talking with my girlfriend over AIM when it happened, and a reboot didn’t fix it. I was able to get into a DOS console and I knew enough at that time to navigate around a bit, but my troubleshooting options were limited. Dismayed, I checked online at a friend’s house for a fix, and someone recommended installing something called Ubuntu.

Folks, I called Best Buy and asked if they sold Ubuntu.

Needless to say, they did not. But through a series of web searches and emails to something called a “LUG“, I was able to get an ISO for Ubuntu 7.04 burned to a CD and installed over my dead XP box. I struggled at first, wondering why this supposedly “awesome” OS couldn’t even run a .exe file. The terminal was not new to me but these commands were. But as with the hacking and the programming, I spent several months hooked in, occasionally needing to reinstall the OS when things broke.

College

After graduating high school, I enrolled at Century College to pursue my Associate’s in Computer Forensics. I chose that degree because, excepting Computer Graphics (which was not something that held any interest for me), it was the one computer-related area I had zero experience with. I had learned programming and networking and databases and security and Linux in my high school days, and “Computer Science” was too broad for my liking, so Forensics it was. Experientially, I enjoyed it. Practically, I have utilized it maybe two times in total. So it goes.

My First IT Job

My first IT job was in 2012 as a sysadmin at a local ISP called US Internet. It was my first “real” job at the tail end of my time at Century. The bulk of my short time there was spent handling support tickets, and migrating the monitoring platform from WhatsUp to Nagios, a process that let me flex my programming skills and get a first taste of automation. Using a combination of perl and python, I was able to convert the config files between the systems and cut the work down tremendously. This was a trend which would continue for most of my career. It was a short gig however, only six months, before I was on to other things.

As it would turn out, “other things” would mean a summer doing landscaping (which I loved), a brief stint in retail (less so), commercial restaurant repair (useful skills for my next job), and a non-trivial amount of time cooking in a restaurant kitchen (which I miss). Honestly, I think more people in IT need to work some of those jobs so we can appreciate how good we have it; I have yet to be burned by hot oil or stung by hornets in infosec *knock on wood*.

Nagios – Support Technician

My next job would signal the true beginning of my IT career, at a place called Nagios, which does infrastructure monitoring. And as luck would have it, I actually had quite a bit of experience configuring Nagios. The interview process went smoothly, and I started in September of 2013. I have a lot of fond memories of that place and I am proud of my work and my team in those early days. There were 12 people when I started if memory serves, and about 45 when I left in 2018.

I started as a Support Technician, and that was an absolute trial by fire. There were five of us, and we learned whatever we needed to in order to fix the customer’s server: database optimization, firewall administration, package management, performance tweaking, you name it. We dove in and out of C and PHP to fix bugs when the devs were too busy. We hacked together solutions on the fly which ended up holding for years. I probably learned more there than at any other single job since.

I also gave two talks while there at our annual world conferences, if you’re at all interested:

• Trevor McDonald: Monitoring The Physical World With Nagios and Arduino – Nagios Con 2014
  • https://github.com/tmcnag/nagduino
• Trevor McDonald: Nagios XI Under the Hood | Nagios Con 2015

Nagios – Support Manager

In February of 2015, I was promoted to Support Manager. This was a major high point in my career then, and I still count it as one today. I was a capital-M Manager, and had the pay to match. By then the company had grown, and I had between four and eight people under me throughout the years. I improved processes and documentation. I handled escalated tickets. I acted as the security SME. I taught 20 interns. I did performance reviews. I approved PTO. I allocated bonuses. I cross-trained people. I hired people. I had to fire some.

I was a capital-M Manager.

But, being a technical person at heart, I couldn’t leave well enough alone. Our QA was still a very manual process, and I wanted to automate it. We had a big whiteboard with a grid of tasks to complete for each release, and to my mind this was a perfect starting point. I spent a few months hooking up Jenkins, Ansible, Docker, Testcafe, and some one-off scripts I wrote. At the end of it, we had a push-button solution for automated end-to-end QA from installation right on through to UI testing.

DC612

Up until this point, security was mostly just a hobby. It was not a major part of my day-to-day, but when a vulnerability report would come in or I’d find one myself that was a good day. In 2016, I took over running the local DefCon group DC612. I had been attending for years by then, and the previous leader stepped down so I asked if I could run it. He said yes, and this would turn out to have several really positive career impacts over the following years. But more about that later.

Nagios – Operations Engineer

In 2017 I voluntarily traded my Manager title for an Operations Engineer one. I continued down this line of work until my last days there. I worked with the Sales team to build the “Find A Partner” web page (which is, to my delight, still in operation largely unchanged). I automated license renewal reminder emails, leading to (if memory serves) something like a 10% increase in renewal revenue. I was the POC for the security@ emails, helping validate and remediate reported vulnerabilities. I leaned more heavily into development, helping pare down a backlog of bug and feature tickets. I found and fixed vulnerabilities. All while frequently landing in the top 25% in CTFs on weekends.

Gray Duck DevOps

As almost a side note here, a co-worker and I founded a consulting LLC around this time called Gray Duck DevOps. We didn’t land a single client doing DevOps work, but I would later do a few freelance pentest jobs (spoiler alert) through it. My business partner mostly handled the admin and paperwork side while I did the consulting. It was a learning experience for sure, but we shuttered it in 2020 amicably.

Freelance

Back to the impacts that running DC612 had on my career.

The first is that at the end of one of our meetings in 2017, a gentleman by the name of Josh More (who I respect greatly) asked if anyone would be willing and able to take on a penetration test a client of his needed. He stressed that he wanted it to go to someone who was trying to get into the field, which I was. Being the group leader I didn’t want to be the first to jump on it, but when nobody else did he got my contact info and we started talking.

That first penetration test was another high point in my career. I was terrified. Impostor Syndrome set in immediately and didn’t let go until the check cleared weeks later. I had very little experience with network pentesting, having spent considerably more time in the web space. I Googled my heart out, staying up reading articles until 3AM some nights, to make sure I got it right. This was where I learned about Responder, and hashcat, and where I got to practice using Metasploit. So many of the things I read I ended up not using on that test but would lay the groundwork for the future.

I got Domain Admin.

At this point, I started considering moving fully into penetration testing. I had some real security chops now, and I took on a few more tests from Josh and started building up my resume. Around this time I also learned I was soon to be a father. I had been at Nagios for about five years at this point, and the thought of changing jobs while also taking care of a newborn was intimidating. But I felt I had been well prepared by my time there, and so I resolved to make it happen.

(Nagios did later name an office after me, which is cool)

RedTeam

By pure chance, I ran into another gentleman at a local security conference after-party in a bar. I hadn’t even attended the conference, but the party was open to whoever. He was the only person there who didn’t look like an IT worker. Tattoos, piercings, shaved head, goatee. More a biker than an admin, so of course I introduced myself. Turns out, he was looking to hire a penetration tester for a small consulting firm called RedTeam Security. I’d link to them, but they’re no longer around, having been absorbed at some point in the past few years.

I applied, I interviewed, I got the job. Another high point. I did have to take a pretty hefty salary cut, but it was manageable and worth it in my eyes. RedTeam was even smaller than Nagios, having I believe nine or ten people total, two of which were not involved in the daily operation. Four of us were testers, and we had two sales people and two managers. It was great. We hacked, we drank, we played Hackers on VHS in the background. My son was born (high point). I got in shape (high point). We traveled across the country. I did my first (and so far only) physical pentest, a successful one I might add. And I learned, and improved, and automated, and coded. I’d happily work with any of those testers again.

I was a capital-P Pentester. It was a good time.

Surescripts

Once again, running DC612 would prove to be a career booster. A regular attendee reached out to me on Twitter and we connected and started talking. He was building out an internal red team at a place called Surescripts and wanted me to be his first hire. He had me apply for the Senior Information Security Testing Analyst position, and I landed an interview in late 2019.

Everyone thought I was a good fit, except for one person. Culturally, they were all in agreement. But he had some reservations about the Senior part. And honestly, looking back at it now he was right. I was on the cusp. Probably another year and I’d be there. But thankfully, after some consideration they offered me the non-Senior role and I accepted, starting a day before my 29th birthday. Another high point.

Things have been a whirlwind since then. I landed a promotion to the Senior role in 2021, about a year and a half after starting. COVID hit and we all started working from home. We got a second pentester, who I mentor. I assumed ownership of the Security Champions program, which I run to this day. My boss got a promotion to Director. A new Manager was promoted between us, but I mostly kept working with my first boss. Then he (first boss) was let go. I stepped up to take over some of his responsibilities and started learning about the blue team side of things. I discovered I quite like it. I’ve been doing much more of that this past year, learning about SIEM and SOAR and IR and generally mentoring and supporting that side of the house as well.

If you want to know more about my current work, feel free to reach out on LinkedIn or to contact me.

More Freelance

Shortly after COVID, DC612 would once again provide me with a career trajectory alteration. Yet another gentleman – I believe that makes it four now – named Bryce Austin (who I also respect greatly) reached out asking for help with incident response. Specifically, a client of his had their site hit and infected with a webshell and he wanted a forensic analysis and cleanup. Similarly to when Josh asked if anyone wanted to do a pentest, I deferred to the rest of the group but nobody spoke up, so we started talking.

The work that man sent my way over the next few years and continuing today literally paid for the down payment on my house. It’s no exaggeration to say that I would not be where I am without him.

Today

So that’s my life story, or at least the infosec parts. I officially received my CISSP approval today (October 24, 2025), which sort of prompted the creation of this site and this writeup. There’s only so much you can put into a resume and cover letter, so I figured this could provide some context for anyone who is interested. It also was nice to reminisce about some of those periods of my life.

The Future

I don’t know what the future holds, and that’s probably a good thing. But my plans are to continue learning, stay curious. I am two-thirds of the way through the CISM study guide and I plan to take that exam in a month or so. I am passively studying Swedish (I love world languages, and have a working proficiency in Spanish). I might write about some more of those non-tech things, because I think it’s important – especially for those just getting into the field – that people see there is more to life than bits and bytes.

At any rate, thank you for reading.

This is the short “resume” version. For the longer “story” version, see here: My Story

---

Surescripts (2019 – Present)

Senior Information Security Testing Analyst (March 2021 – Present)

My duties as a Senior include those below, and expanded in scope and responsibility to also include:

• Leadership
  • Provide mentorship to non-Senior penetration tester
  • Penetration testing project management
  • Third-party penetration testing vendor interfacing
  • Act as subject matter expert during security incidents
  • Ownership of the Security Champions program
• Product Security
  • Participate in code review of vulnerabilities reported in SAST platform
  • Advise on vulnerability remediation and best practices
  • Perform validation of remediated vulnerabilities
  • Increase product testing coverage through streamlined onboarding
• Engineering
  • Improve XSOAR playbooks and Splunk alerting
  • Oversee migration to Google SecOps
  • Automate Jira workflows to increase productivity

Position Highlights:

• Improved relations between Security and Development departments. This may be the highlight of my entire career. When I first came to Surescripts, there was tension between the Development and Security departments. We were seen as being the Department of No, and a source of additional work. Through my years of positive relationship building, developers now feel comfortable proactively reaching out with security questions. This has increased cooperation, reduced conflict, and overall improved the culture and security of the organization.
• Technical resource for QHIN designation process. From September 2024 through March 2025 I acted as a key technical resource for achieving the Qualified Health Information Network designation from TEFCA. I oversaw the requirements to have a third-party penetration test and an internal vulnerability scan, as well as the remediation of key findings. I automated the generation of Jira work items for these to streamline the process between departments.
• XSOAR and SecOps automation. I assisted our Incident Response team by fixing issues in our XSOAR deployment, and by designing a new Detection-as-Code workflow for managing our SecOps platform. I provided mentorship and technical expertise during the migration process.
• Workflow and process improvement. Several processes were either undefined or in need of review. I formalized these in documentation and, where appropriate, created Jira workflows to reduce confusion and increase time to resolution. These included automation steps to gather and parse data, inform key stakeholders, and manage transitions between task statuses.

Information Security Testing Analyst (November 2019 – March 2021)

As a testing analyst (penetration tester) my duties primarily include performing penetration testing of web and API applications handling PHI in accordance with HIPAA requirements.

---

RedTeam Security (2018 – 2019)

Security Consultant (July 2018 – November 2019)

My primary focus was performing penetration testing across diverse client environments. This included web, API, internal network, external, wireless, social engineering, and physical testing. Original research, tool development, technical blog post writing, and pre-sales calls were performed as part of these duties.

In addition, I acted as a mix of developer, sysadmin, and operations internally by:

• maintaining and automating our internal testing and interview environments
• further developing our existing in-house reporting automation platform

Position Highlights:

• Discovered three separate vulnerabilities in a single functionality. In one application’s RSS-based news feed functionality, I discovered persistent XSS, timing-based internal network discovery via SSRF, and XXE file exfiltration leading to SMB credential harvesting.
• Invited for discussion with new owner post-exit. After my departure and the company’s acquisition, I was asked to lunch by the new owner to provide my insight and recommendations for the company. We discussed a paid consulting position to maintain the systems I developed, which I ultimately declined.

---

Nagios (2013 – 2018)

Operations Engineer (August 2017 – July 2018)

In my operation engineering role, my tasks primarily focused on business improvement such as:

• Automating key processes for the Sales team
• Hosting weekly “Lunch and Learn” training sessions across teams
• Actively assisted in development and sales activities

I continued to serve as the security SME. In addition, I acted as the Support Lead, continuing to assist with escalated tickets and provide mentorship and leadership to the Support Team.

Position Highlights:

• Automation of renewal reminder emails. I increased annual renewal revenue by approximately 8% by sending renewal reminder emails to customers 60 days before their licenses were set to expire.
• Creation of https://www.nagios.com/find-a-partner/. I created a management backend and display frontend for listing official resellers. Previously this was a manual process which required the Sales team to edit HTML by hand.
• Bug and feature backlog trimming. I lead a cross-functional effort to reduce a backlog of bug reports and feature requests from over 3,000 to under 500. This effort included myself, the lead developer, and a lead Sales technician reviewing each item over a period of a week.

Support Manager (February 2015 – August 2017)

While managing the Support Team, my duties included those below, plus:

• Interview, hire, and train new employees
• Create official training materials for staff and customers
• Handle escalated customer support tickets
• Improve internal processes and procedures
• Conduct performance reviews and allocate bonuses
• Create and review team performance metrics
• Liaison with Development, Sales, and Marketing teams
• Act as security SME, handling security@ email submissions

Position Highlights:

• Automation of manual QA processes. I converted our manual, whiteboard-based QA process into a fully-automated end-to-end pipeline. Using Jenkins, Docker, Ansible, Testcafe, and custom scripts, I automated the entire process from VM provisioning, software deployment and configuration, baseline testing, functional testing, and UI testing.
• Training of 20 interns during our internship program. I spent several weeks providing hands-on training and career coaching to 20 interns, focusing on technical skills and customer support. Many of these interns we would later hire on as full-time employees.
• Creation of https://repo.nagios.com/. I created the site and automated the generation of both RPM and DEB packages for installation of our commercial software.
• Acted as security SME. I was the point of contact for all emails to the security@ address, triaging and managing the validation and remediation of all reported vulnerabilities. In addition, I personally discovered and reported or fixed over a dozen vulnerabilities.

Support Technician (September 2013 – February 2015)

As a support technician, my day-to-day work consisted of:

• Providing customer support across a variety of industry verticals
• Reporting bugs and feature requests to developers
• Documentation including
  • Support procedures
  • Troubleshooting
  • Performance tuning
• Testing of new releases
• Developing new monitoring plugins
• Performing “Quickstarts” for prospective customers

Position Highlights:

• Providing extended support for disaster scenario. A client called in near EOD stating that their primary datacenter had suffered a total loss in a fire. I stayed on the line with them for three hours to ensure that they had a fully functional monitoring setup in their failover environment.
• Providing multi-lingual support for Spanish-speaking clients. Several clients either spoke Spanish exclusively or their English proficiency was low. My working proficiency in the Spanish language helped ensure they received proper support.

---

U.S. Internet (2012)

Systems Administrator (January 2012 – June 2012)

As a sysadmin, my day-to-day work consisted of handling tickets including:

• Customer support escalations
• System and workstation support
• Datacenter hardware installation

Position Highlight: Handling the migration of 2,500+ configuration files from an obsolete monitoring platform to Nagios. Using custom Perl and Python scripts, I automated the configuration translation of configurations between the systems. I then manually configured the remaining items which were not directly mappable between systems, such as event handlers, notifications, and reports.

---

Education and Certifications

ISC² Certified Information Systems Security Professional (CISSP) (2025)

I passed my CISSP exam in September and received formal acceptance in October.

GIAC Web Application Penetration Tester (2021, expired)

I passed my GIAC GWAPT exam in February 2021.

Century College (2009 – 2012)

Associates of Computer Forensics

Studies included filesystems, storage devices, data recovery, file identification, data collection, evidence handling, criminal law, system and network security, programming, and operating system fundamentals.

Extra-curriculars included volunteering in the free computer repair lab, and co-running the Hacking Club.

---

Miscellaneous

Freelance Work (2017 – Present)

I perform occasional penetration testing on nights and weekends as my schedule allows. This work is carefully selected by me and approved by my employer so as not to provide a conflict of interest.

DC612 Security Group (2016 – Present)

I run a security group called DC612, the DefCon Group local to the 612 area code. We cover a diverse range of topics in our monthly presentations and maintain an active Discord server.

Gray Duck DevOps, LLC (2017 – 2020)

In 2017, myself and a co-worker founded Gray Duck DevOps in order to provide automation consulting to the Twin Cities. The LLC was amicably dissolved in 2020 due to conflicting priorities with both parties.