Security-focused IT in Tacoma, WA. Compliance, security operations, and AI risk assessment for a living. Security tooling the rest of the time.

Cinder — Digital forensics toolkit for Windows and Linux, written in C#. Host artifact collection and analysis. What remains tells the story.

zest_ssh_core — The SSH transport behind ZestSSH, hardened from dartssh2. Weak algorithms off by default, Terrapin (CVE-2023-48795) strict KEX. MIT.

Most of my other work is closed source. The two published apps:

• ZestSSH — Cross-platform SSH client for Android, iOS, and desktop. Credential sync is zero-knowledge and end-to-end encrypted (AES-256-GCM, Argon2id KDF, the server only ever holds unreadable blobs). Design notes and the full whitepaper are at zestssh.com/security.
• Recipe Spellbook — Cross-platform recipe app. Google and Apple OAuth, tiered E2E cloud sync, universal import. Full-stack solo build including the self-hosted backend.

Before those, three published games. Around 300,000 cumulative users across everything.

Systems administration and security lead for a multi-state industrial distributor, on a three-person IT team covering roughly 570 endpoints. Led the org's first NIST SP 800-171 program to a 92/110 SPRS score through in-house gap analysis, control remediation, and a NetBox asset inventory, currently pushing higher ahead of a CMMC Level 2 assessment.

I also led the security, privacy, and risk assessment for the company's first customer-facing LLM deployment, covering vendor data-handling and retention review, control validation (server-side action allow-listing, human escalation, kill switch, audit logging), and liability review with legal counsel and the insurance broker.

Day to day: alert triage and investigation in Microsoft Defender and M365, log analysis across Defender and Zabbix, detection and policy tuning, incident response, and reporting to management. Plus an internal phishing simulation and awareness program on GoPhish, a Nessus vulnerability assessment with a written remediation plan, and endpoint hardening through Group Policy.

Where the detection work happens. A SOC on Wazuh, Zeek, and Graylog for rule development, log analysis, and threat hunting, running on a clustered Proxmox HA setup across seven segmented VLANs, with inter-VLAN policy enforced on OPNsense. Internal services sit behind a reverse proxy with Authelia as the SSO/MFA provider, enforcing per-application authorization at the proxy before a request ever reaches the service. Remote admin access runs over a self-hosted Headscale control plane with WireGuard tunnels, so there is no third-party dependency in the auth path into my network and no exposed management ports. Public-facing services (websites, Discord bots) run on their own VMs in the server segment, fronted by Cloudflare with TLS via DNS-01, kept off the management segment where the SOC and administrative tooling live. I gray-box pentested the whole thing and wrote up the findings, including a high-severity SSO bypass, checked against an independent Nessus baseline. The cluster runs on UPS-backed power with automated graceful shutdown.

Finishing a BS in Information Assurance and Cybersecurity at UW Tacoma, minor in Data Analytics. CompTIA CySA+, Security+, A+, and Microsoft AZ-900.

Headed toward GRC and AI security. Open to full-time security roles and contract work.

LinkedIn · zestssh.com · arliethefourth@gmail.com

Working in: C# · Dart/Flutter · Python · PowerShell · Bash · Java Around: Microsoft Defender · Wazuh · Zeek · Graylog · Nessus · Zabbix · NetBox · Proxmox · OPNsense · UniFi · Docker · Linux · Active Directory · nginx · Cloudflare