I build and operate security programs end-to-end — policy, tooling, detection, remediation, metrics. My portfolio focuses on turning frameworks into running systems: Nessus scans that actually lead to patched hosts, KQL hunts that catch real adversary behavior, NIST controls mapped to concrete evidence.
Currently focused on: vulnerability management programs, risk-based remediation at scale, and detection engineering in cloud environments.
| Project | Outcome |
|---|---|
| Vulnerability Management Program | End-to-end VM lifecycle on Azure using Tenable Nessus — policy, scanning, risk-based prioritization (EPSS + KEV + CTEM), remediation. 80% vulnerability reduction over 3 cycles. |
| Programmatic Remediations | PowerShell + Bash remediation scripts mapped to Tenable Plugin IDs — SSL/TLS hardening, SMBv1 removal, Telnet removal, registry-based controls. |
| Nessus Report Parser | Python CLI that enriches Nessus findings with EPSS + CISA KEV and assigns RBVM priority tiers (P0-P3). Risk-based prioritization that goes beyond CVSS. |
| CVE Deep-Dives | In-depth technical writeups for high-impact vulnerabilities — root cause, exploitation mechanics, detection queries (KQL + Sigma), hunting, and remediation. Covers Log4Shell, Citrix Bleed. |
| Project | Outcome |
|---|---|
| Threat Hunt — Tor Browser Usage | Hypothesis-driven hunt using Microsoft Defender for Endpoint and KQL to detect unauthorized Tor installation, execution, and network activity. |
| Azure Sentinel SIEM Lab | Cloud-native SIEM deployment with custom KQL analytics rules, SOAR playbooks, and MITRE ATT&CK-mapped detections. |
| SOC Cloud Engineering | Splunk SPL detections, Qualys VMDR integration, QRadar AQL, and multi-cloud (AWS/Azure) monitoring content. |
| Active Directory Security Lab | Detections for Kerberoasting, DCSync, Golden Ticket, and AS-REP Roasting using Sentinel KQL against a live AD environment. |
| Network Traffic Analysis | Wireshark/tcpdump packet analysis for C2 beaconing, DNS tunneling, and ARP spoofing — plus Suricata signatures. |
| Project | Outcome |
|---|---|
| NIST 800-53 Compliance Mapping | Rev 5 control assessment, gap analysis, POA&M development, and risk scoring. |
| Cloud Security Posture Assessment | Azure assessment against CIS Benchmarks v2.0 with a prioritized remediation roadmap. |
| STIG Implementation | DISA STIG hardening for Windows — CAT I/II/III finding remediation and compliance documentation. |
| Project | Outcome |
|---|---|
| Incident Response Playbook | Enterprise IR playbooks for malware, phishing, ransomware, brute force, and insider threats — NIST 800-61 and SANS aligned. |
| Security Awareness Program | Awareness program with phishing simulations, role-based training tracks, and metrics-driven reporting. |
| Vulnerability Assessment Report Template | Executive-ready assessment template — summary, risk scoring, findings, remediation roadmap. |
Cloud & Platforms: Microsoft Azure · Microsoft Sentinel · Defender for Endpoint · Active Directory · Windows Server · Linux
Vulnerability Management: Tenable Nessus · Qualys VMDR · CVE/CVSS · MITRE ATT&CK
Detection & Response: KQL · Splunk SPL · QRadar AQL · Sigma · Suricata · Wireshark · tcpdump
Automation: PowerShell · Bash · Python
Frameworks: NIST SP 800-53 Rev 5 · NIST SP 800-61 · DISA STIG · CIS Benchmarks · MITRE ATT&CK · SANS IR
- LinkedIn:ryan-murphylee
- GitHub Issues on any repo for questions or feedback
Open to vulnerability management, detection engineering, and security operations roles.