Data Scientist, National Security Agency
Aug, 2022 - Jan, 20263 years 5 months
Conducted digital network exploitation and threat analysis in support of cyber operations while identifying gaps in analytical workflows and building full-stack data pipelines, Python tools, and web UIs to automate collection, enrichment, and visualization of operational data for analysts and stakeholders.
Developed and maintained 15+ mission-critical Python-based analytical tools and bespoke libraries, serving thousands of active users across a 20,000-analyst enterprise, providing ongoing user support, issue resolution, and codebase management.
Architected 3 full-stack web applications with React front-ends delivering intuitive interfaces for real-time querying, enrichment, and visualization of operational data against backend databases.
Engineered a custom parsing engine to ingest and normalize unstructured, organically formatted operational data into a structured graph database, powering automated network visualizations across environments with thousands of potential nodes.
Designed and deployed a distributed job scheduling system on operational infrastructure, orchestrating complex cross-network data routing from forward-deployed systems to agency-level data warehouses.
Established CI/CD pipelines via GitLab to ensure continuous integration, automated testing, and rapid deployment across all analytical tools and data platforms.
Architected 3 end-to-end automated ETL platforms handling ingestion, transformation, enrichment, standardization, and persistent storage of operational data — each fully replacing a dedicated full-time manual data management role.
Engineered a multi-stage automated data pipeline for a SOCOM unit that captured operational results, routed them through complex multi-enclave network environments to agency data warehouses, and surfaced enriched data through a purpose-built internal query and visualization platform — fundamentally transforming how the unit conducts cyber analysis.
Built high-throughput data processing workflows leveraging PySpark, Polars, and Pandas for large-scale transformation and enrichment of structured and unstructured operational datasets.
Pioneered 10+ novel data fusion methodologies linking disparate datasets to surface previously inaccessible insights, directly influencing hundreds of intelligence reports disseminated to 1st, 2nd, and 3rd party stakeholders.
Developed analytical tools that automated labor-intensive workflows previously requiring 1–3+ hours of manual effort per execution, eliminating thousands of cumulative analyst-hours across the enterprise.
Built an automated reconnaissance tool leveraging Shodan enumeration against active access to rapidly identify potential access vectors toward target space — enabling analysis at a scale and speed infeasible through manual methods.
Created advanced automated analysis capabilities that surfaced critical insights from operational data at volumes impossible through manual tradecraft, enabling discovery of high-value intelligence that would otherwise remain undetected.
Delivered 4 formal training sessions to hundreds of analysts on purpose-built analytical tools and operational methodologies, accelerating adoption and standardizing workflows across the agency.
Served as primary analyst for hundreds of cyber operations over a 3-year period, producing hundreds of network topology maps and identifying hundreds of high-value targets in direct support of national security objectives.
Developed an automated network mapping capability that generates comprehensive topology visualizations for networks with thousands of potential nodes, reclaiming hundreds to thousands of analyst-hours previously consumed by manual mapping.
Identified hundreds of exploitable vulnerabilities during an intensive 6-month operation, directing offensive cyber operations against discovered attack surfaces, triaging compromised devices, and conducting follow-on exploitation analysis — recognized with a Joint Commendation Medal.
Directed and executed cyber operations encompassing network discovery, threat analysis, and vulnerability assessment, enriching operational findings and delivering actionable intelligence to SOCOM mission planners and decision-makers.
Developed novel tradecraft fusing disparate data sources to enable target discovery, network enumeration, and kill chain development, directly influencing hundreds of operational reports.
Recognized as Military Performer of the Quarter on 4 separate occasions for sustained technical excellence and operational impact.
Awarded Joint Commendation Medal for exceptional performance across a 6-month cyber operation yielding hundreds of actionable findings.
Delivered 4 formal training sessions to hundreds of personnel on custom-built analytical platforms and operational methodologies, driving enterprise-wide capability adoption.