24/7 SOC leadership
Running continuous monitoring operations across shifts, tiers and time zones.
- Shift design and coverage models
- Tiered triage and escalation
- Runbooks and playbook governance
CISSP · GPEN · GCIH / Adversary Emulation, Detection & Response
Defense that thinks like the adversary.
I lead security operations centers and offensive security teams. One side detects earlier and responds with discipline. The other tests those defenses the way real attackers would. Both report in language the board understands, backed by hands-on depth in SIEM, SOAR, identity and penetration testing.
Director of Cybersecurity
Director of Security Operations
Head of SOC Operations
Head of Cyber Defense
Head of Offensive Security
Red Team & Adversary Emulation Lead
Posture: monitored
01 Leadership
An operator who speaks executive.
Exceptional security programs are built by people, not technology. Technology amplifies the culture, leadership and talent behind it. People first, technology second.
My work sits where the analyst floor meets the boardroom. I build and run 24/7 security operations, set the service levels the business and its executives hold us to, and develop the analysts and engineers who meet them. I stay close enough to the tooling to challenge a detection rule or a pentest finding, and far enough above it to tie the work to business risk.
I lead from the offensive side as well. Penetration testing, red team and adversary emulation work shows whether defenses hold up against the techniques real attackers use, and the findings go straight back into detection and response.
When I joined FIT Cybersecurity as SOC Manager, analyst burnout, low morale and turnover were persistent problems. Within six months I helped reduce turnover to under 5% by restructuring the SOC, balancing workloads and making operations more predictable. The goal was a culture where people could thrive and do their best work.
I never ask my team to do something I wouldn't do myself. That has meant long nights of ransomware containment, payload unpacking and building multi-zoned Suricata pipelines alongside them. I've also interviewed hundreds of cybersecurity professionals and invest heavily in coaching and mentorship.
I’ve spent 25 years in cybersecurity. Industries served · Industrial · Finance · Healthcare · Legal · Risk Management · Local Government
People first, technology second
Culture, workload balance and support come before the tool stack.
Lead from the trenches
Visible and engaged during critical incidents, never asking for work I wouldn't do.
Develop the bench
Career paths that turn Tier 1 analysts into the next generation of leads.
Translate for the business
Concise reporting that executives and clients can act on.
Security service delivery
Running security operations as a measured service with clear commitments to the business.
- Service onboarding and SLAs
- Service reviews and advisory
- Business-unit alignment
Incident response
Leading containment and recovery with calm, documented command.
- Severity classification
- Threat management and hunting
- Post-incident review
KPIs, SLAs and reporting
Building metric frameworks that show operational health and risk trend.
- SLA definition and tracking
- Executive and client dashboards
- Operational reporting cadence
Process and quality
Continuous improvement of how the operation runs and how work is checked.
- Quality assurance programs
- Workforce optimization
- Process standardization
Stakeholders and teams
Leading analysts and engineers while partnering across IT, legal and the business.
- Cross-functional leadership
- Executive communications
- Client relationship management
Offensive security leadership
Leading penetration testing and red team work that finds weaknesses before attackers do.
- Network, web and API penetration testing
- Red team engagement planning
- Rules of engagement and scoping
Adversary emulation
Replaying real threat-actor techniques to prove whether detections and responders hold up.
- Threat-informed emulation plans
- Purple team exercises with the SOC
- Detection gap reporting
02 Operating model
How an incident moves through a well-run SOC.
The lifecycle I build teams, tooling and metrics around. Each stage has an owner, a measure and a handoff.
STAGE 1
Detect
Tuned SIEM correlation and EDR telemetry surface the signal worth a human's time.
MTTDSTAGE 2
Triage
Tiered analysts validate, enrich and assign severity against a shared rubric.
MTTA · P1–P4STAGE 3
Respond
SOAR playbooks and incident commanders contain the threat with documented decisions.
MTTCSTAGE 4
Recover
Systems return to service, stakeholders are briefed, and leadership gets a clear account.
MTTRSTAGE 5
Improve
Lessons learned and adversary emulation results feed detections, runbooks, training and the next quarter's priorities.
QA · coverage| Measure | What it tells leadership | Results achieved |
|---|---|---|
| MTTD | How quickly threats are noticed once they occur | 2 min 19 sec |
| MTTA | How quickly a person takes ownership of an alert | 6 min 23 sec |
| MTTR | How quickly the business is back to normal | About 120 min |
| SLA adherence | Whether commitments to the business and executives are being met | 96% |
| Analyst turnover | Whether the team is stable enough to retain expertise | Under 5% within six months |
| False-positive reduction | Whether analyst time goes to real threats | 87% fewer false positives |
· Video currently being produced
03 Technical depth
Hands on the tools the team uses.
Directors who understand the stack make better calls on staffing, tuning and vendor spend. These are the platforms and disciplines I work in directly.
Detection & responseSIEM · SOAR · EDR
Rapid7 InsightIDRSIEM engineeringSOAR automationMicrosoft DefenderEndpoint threat detectionSuricata pipelinesRansomware containmentPayload unpacking
Incident workflowCase management
ServiceNow Security Incident ResponsePlaybook designThreat management
Exposure managementVulnerability · Pentest
Rapid7 InsightVMVulnerability managementPenetration testingBurp Suite ProfessionalNmapSecurity testing frameworks
Adversary emulationRed · Purple team
Adversary emulationRed team operationsPurple team exercisesMITRE ATT&CK mappingDetection validationAI-assisted testing in Burp Suite Pro with OpenAI and Claude Opus models
Application securityWeb · API
Web application assessmentsAPI security assessmentsAPI penetration testingBroken Object Level Authorization (BOLA) verificationJWT tampering and auditing
Identity & cloudZero Trust
Microsoft Entra IDConditional Access policiesToken-based MFACloud securityIdentity securityZero Trust architectureSecurity architecture
EmergingAutomation · AI
Security automationAI-assisted triage and analysisAI security risk
Jan 2022 – Nov 2026
Purple Team Operations Manager
FIT Cybersecurity
- Led 24/7 SOC operations and the analysts and engineers who ran them, taking over management duties after the team lost two managers and a penetration tester in six months.
- Grew the analyst team from 4 to 9 in less than a year.
- Introduced bi-weekly, TED Talk–style training sessions for the team.
- Owned KPI and SLA reporting for executive and business stakeholders.
- Reduced false positives by 87% by tightening authentication controls, including token-based MFA and Conditional Access policies, and building SOAR workflows.
- Separated SIEM event-source inactivity alerts from the analyst queue and routed them to engineers, so analysts could focus on threats.
- Helped reduce analyst turnover to under 5% within six months by restructuring the SOC, balancing workloads and improving operational predictability.
- Worked hands-on in critical incidents and engineering, including ransomware containment, payload unpacking, multi-zoned Suricata pipeline builds and penetration tests.
Oct 2011 – Jan 2022
Principal Cybersecurity Incident Responder / Handler
Watchtower Bible & Tract Society of New York
- Spearheaded global cyber incident defense strategies against high-profile, targeted threat actors, leading detection, containment and response across the organization’s worldwide operations.
- Built and designed the organization’s first Cybersecurity Operations Center.
- Assessed threats, risks and vulnerabilities from emerging security issues to advise stakeholders on appropriate measures.
Oct 2009 – Oct 2011
Senior Cybersecurity Engineer · Offensive Security
HP Enterprise Services
- Led teams of up to 20 in developing and implementing security systems, resulting in 60% fewer threats over 6 months.
- Implemented controls and procedures to protect information system assets from intentional or inadvertent modification, disclosure or destruction.
- Installed and maintained commercial firewall solutions, working with security vendors to consistently apply best practices and software updates.
Jan 2007 – Aug 2009
Senior Cybersecurity Engineer
Holiday Inn Vacations
- Built a Zero Trust information security program, including the design and implementation of an enterprise policy framework, for a multi-satellite hotel network in Central Florida.
- Served on the Executive Information Security Oversight Committee, which reviews changes to corporate information security policy.
- Supported and hardened an enterprise Red Hat Linux infrastructure to enforce strict access control.
- Orchestrated regular penetration testing using industry-standard OSSTMM 3.0 and NIST methodologies. Deployed Snort IDS and Cisco AIP-SSM IPS, and tested with open-source tools such as Nessus, Nmap, Metasploit, N-Stalker, Cain & Abel, BackTrack and Helix.
05 Credentials
Education, certifications and affiliations.
Certifications
- GIAC Penetration Tester (GPEN)2023
- GIAC Certified Incident Handler (GCIH)2010
- CISSP2005
Education
- Associate in Information Technology, Valencia College2005
- SANS Mentor, Incident Handling2009
Community
- GIAC Advisory Board, Offensive Security
06 Recommendations
In the words of those I've worked with.
Four analysts and engineers who reported to me directly, on what it was like to work on my team.
Rudy is the kind of leader who makes a team stronger just by being part of it.
Rudy interviewed and hired me for my first role in cybersecurity, and I’ll always be grateful he took a chance on me. As my SOC manager, he set the tone for the whole team.
What stood out most was how much he cared about the people in the SOC. He worked hard to keep the team together and made sure our concerns were heard and acted on, which mattered a lot on overnight shifts where it’s easy to feel disconnected. He was also excellent at handling difficult client situations, staying calm and professional while protecting both the client relationship and his analysts.
Rudy joined the company when we needed him the most.
Our team had lost 2 managers and a PenTester in a 6 month period. Rudy came in and took over management duties, as well as participated in several PenTests. Our team grew from only 4 analysts to 9 in less than a year. As the SOC manager, Rudy implemented bi-weekly training in a Ted Talk style forum for the team.
He is a manager who puts people first.
Rudy was an exceptional manager during my time working with him as a Cybersecurity Analyst/Engineer at FIT Cybersecurity. During our bi-weekly 1:1 meetings, he was a great listener and did his absolute best to align each security team members goals with that of the mission of the company. He trusted the skills and abilities of his team and allowed us to perform the work we were hired to do.
Rudy has a remarkable ability to lead with both intelligence and empathy, creating an environment where I felt encouraged to tackle challenges I didn’t initially think I could handle.
Working under Rudy for nearly three years has been one of the most transformative experiences of my career. He’s not only an exceptional leader but also a mentor who truly cares about the growth and success of his team. His guidance has had a huge impact on my professional development, and I genuinely credit much of my success to his leadership and support.
Excerpted from LinkedIn recommendations. Full text on LinkedIn.
References available on request07 Perspectives
On building security teams.
What I’ve learned from interviewing hundreds of cybersecurity professionals.
Hiring · Offensive security
I’m giving away all my secrets: how I hire penetration testers
Read on LinkedIn →
Hiring · SOCHiring the right cybersecurity analyst: why communication skills matter
Read on LinkedIn →
CareersWhat’s more important: certifications or experience?
Read on LinkedIn →
API documentation: a simple way to save time, money, and improve security assessments
One thing I’ve noticed with increasing frequency during API security engagements is the lack of clear, comprehensive API documentation. Having access to an OpenAPI/Swagger specification before beginning an assessment can make a significant difference in both efficiency and cost.
The objective isn’t simply to test every endpoint equally. It’s to understand which endpoints introduce the greatest business risk and prioritize accordingly.
Of course, documentation isn’t a substitute for discovery. I cannot tell you how many times I come across undocumented and forgotten endpoints.
#APISecurity#PenetrationTesting#ThreatModeling#OpenAPI
Read the full post on LinkedIn →
- Know thyselfIdentify endpoints, HTTP methods, authentication requirements and potential exposure points.
- Prioritize by functionalityAn endpoint processing financial transactions deserves different attention than one returning public data.
- Improve threat modelingUnderstand business logic, trust boundaries and the impact of compromised functionality.
- Save time and moneyLess time figuring out what an API does means more time testing what matters.
- Deliver more valueBetter scoping leads to focused testing, meaningful findings and actionable remediation.