Active Secret Clearance CompTIA Security+ B.S. Computer Science, Cybersecurity, 2026

Open to new opportunities • Philadelphia / South Jersey metro • local time

Systems Administratorbuilding towardsecurity engineering.

Active Directory & Endpoint Management · IT Operations · Applied Security

Five-plus years of hands-on IT operations across military healthcare and civilian environments: Active Directory administration, endpoint imaging for 150+ systems, and 1,000+ resolved tickets a year. I build and document real automation and detection tooling outside of work to turn that operations experience into applied security skill.

View Resume GitHub LinkedIn Email Me

hans@portfolio~/ops-console

shell ready

Hans Saisystems administration → security engineering

ROLESysAdmin

CLEARANCESecret

FOCUSSecurity

Why this exists

I didn't learn security from a classroom first. I learned it from locked-out accounts, endpoint fleets that had to come back online, and a ticket queue that never really closes. Every tool on this site exists because the operations work taught me the problem before cybersecurity gave me the language for it.

About

Where I've been, where I'm headed

I administer Active Directory for a secure medical network: user provisioning, account unlocks, and Group Policy enforcement. I reimage and deploy fleets of endpoints with SmartDeploy and PXE Boot, and resolve 12 to 15 Level 2 support tickets a day.

Outside of work, I build the tools I wish existed on the job: an AD and endpoint automation toolkit, a Windows event log threat hunter, a helpdesk analytics engine. Each one is real, tested, and documented, built to turn infrastructure experience into applied security skill rather than certificates alone.

I completed a B.S. in Computer Science with a Cybersecurity focus in May 2026 and I'm looking to grow from systems administration into security-adjacent infrastructure or junior security engineering roles, based in the Philadelphia and South Jersey metro or fully remote.

150+

Endpoints imaged & deployed

1,000+

Support tickets resolved / yr

5+ yrs

IT operations experience

Real tools built & shipped

Experience

Where I've worked

Jul 2026 to Present

IT Support Associate II, Operations Technology

Amazon · South Jersey, NJ

Tier 1/2 support for operations technology (scanners, workstations, network printers, kiosks) across a high-volume fulfillment site
Own allocation and troubleshooting for 300+ operations technology endpoints spanning multiple buildings

Mar 2025 to Aug 2026

IT Support Technician

Shoppers World & Forman Mills · South Jersey, NJ

On-site IT support across multiple retail locations: POS systems, networking equipment, back-office hardware
Closed 500+ tickets through corporate ticketing workflows; maintained a loaner equipment pool to cut store downtime

Jan 2021 to Present

IT Systems Administrator | Health Services Administrator

U.S. Air Force Reserve · 87 MDG / 514 AMDS, JBMDL McGuire, NJ (AFSC 4A0X1S)

Reimaged and deployed 150+ computers via SmartDeploy/PXE Boot; decommissioned 150+ legacy systems for compliance
Resolve 12 to 15 Level 2 tickets a day (1,000+ annually): AD access, network connectivity, printer and system issues
Administer Active Directory for provisioning, account unlocks, and Group Policy enforcement on a secure medical network
Prepare, file, and safeguard patient health records, including admission/discharge/transfer documentation and TRICARE enrollment, in full HIPAA and Privacy Act compliance
Compile statistical and workload reports (staffing, bed occupancy) to support quarterly budget planning
Built a QR-code clinic tracking system and an encrypted HIPAA-compliant records workflow

Sep 2019 to Mar 2025

Organization Technology Pro | Department Manager

McDonald's · Fredericksburg, VA & Medford, NJ

Frontline IT support for POS systems, kiosks, printers, and back-office hardware across two locations
Reduced technology downtime 25% through proactive maintenance; managed scheduling and inventory for a 15-plus person crew

Click to drag & zoom

Everything else here solves a problem nobody outside IT ever sees. This one didn't need to exist: a full 3D, physically-lit recreation of my actual Liberty University diploma, procedural paper and card materials, studio lighting, a folder that opens on drag. Built because the three.js engine idling in the hero above deserved a real object to render, not just a wireframe backdrop. It's live. Drag it.

Three.js Procedural materials Studio lighting Fully interactive

Open full demo Source on GitHub

Log Correlator SIEM dashboard: 34 events ingested, 5 incidents, MITRE ATT&CK techniques observed

Most portfolio "SIEM" projects flag one log line at a time. This one correlates sequences of events across two different log sources: a burst of failed SSH logins immediately followed by a successful one from the same IP is treated as one escalated incident, not two unrelated alerts, mirroring how a real detection-engineering rule chain works. Five rules, each mapped to a MITRE ATT&CK technique ID; zero runtime dependencies; renders as a self-contained HTML dashboard with no build step.

Why I built this

I don't have a live SOC seat yet, so I couldn't point to a real correlation rule I'd shipped. This was my way of proving the thinking anyway: don't just flag a suspicious line, chain it to what came before it, the way an actual detection engineer reads a timeline. If I can't show the seat, I can show the reasoning.

5 correlation rules 25 tests passing MITRE ATT&CK mapped Zero dependencies Cross-source correlation

Live dashboard Source on GitHub

Live chart from the tool's own inline-SVG report generator, rendered from a 620-ticket sample dataset. No image file.

Turns a raw ticket export into SLA compliance, resolution-time, and volume metrics, mirroring real high-volume ticket queue work (1,000+ tickets/year). Zero dependencies; renders its own charts as inline SVG.

Why I built this

Twelve to fifteen tickets a day adds up to thousands a year, and I kept asking the same question nobody was answering: which priority tier is actually missing SLA, and by how much? This is that answer, generated in seconds instead of guessed at.

14 tests passing Zero dependencies HTML + CSV reports

Source on GitHub

AD Security Auditor HTML report: 16 findings, 4 critical, 5 high, 7 medium

Audits Active Directory security posture entirely offline, from exported CSV data: stale accounts, password hygiene, unapproved privileged-group membership, outdated OS versions, and duplicate SPNs. No live domain connection required. Renders a dark-themed HTML report plus CSV/JSON export.

Why I built this

I administer a real production AD environment, so I know exactly how easy it is for a stale account or a privileged-group change to go unnoticed. I wanted an audit I could hand to anyone without touching the live domain: export, run, read the findings.

Pester tested 7 security checks Read-only / offline

Source on GitHub

Phishing Email Analyzer report flagging a critical-risk message with SPF, DKIM, and DMARC failures

Statically analyzes raw .eml files for phishing indicators: SPF/DKIM/DMARC failures, lookalike and homoglyph domains, link-text/href mismatches, urgency language, and double-extension executables. Weighted score with plain-language explanations. Fully offline, never visits links or executes attachments.

Why I built this

Phishing reports land in every help desk queue, and "just don't click it" isn't an explanation. I wanted something that shows its work: which header failed, which domain is spoofed, in plain language, so the answer teaches the reader something instead of just flagging risk.

46 tests passing Zero dependencies Offline / no network calls

Source on GitHub

Click to interact

Real-time encrypted collaborative notepad: shareable editable or read-only links, QR codes, presence and typing indicators, offline drafts, and a PWA install with an OS-level share target. Vanilla JS, no framework or build step.

Why I built this

Everything else here is backend tooling nobody outside IT ever sees. I wanted to prove I can also ship something a stranger opens, understands in five seconds, and actually wants to use, encryption included, because "real-time" and "private" shouldn't be a trade-off.

Live demo Encryption option

Open live demo Source on GitHub

Scanning 214 enabled accounts for LastLogonTimestamp older than 90 days...

What if: Performing the operation "Disable AD Account" on target "jsmith (OU=Sales,DC=corp,DC=local)".
What if: Performing the operation "Disable AD Account" on target "r.chen (OU=Support,DC=corp,DC=local)".
... 10 more, see report ...

12 accounts flagged inactive · 0 disabled (-ReportOnly) · report written to reports\inactive-2026-08-31.csv

Representative -WhatIf/-ReportOnly console output, formatted to match the script's real logging module. It targets a live AD domain, so this isn't a hosted demo.

Scripts for AD user provisioning/offboarding, stale-account cleanup, hygiene reporting, and endpoint compliance audits. Every write action supports -WhatIf; every run produces a log and CSV report.

Why I built this

Provisioning and offboarding by hand is repetitive, which means it's exactly where mistakes happen. Every write action here defaults to -WhatIf first, because I wanted automation I'd actually trust against a real domain, not a script that just moves the risk somewhere less visible.

SupportsShouldProcess PS 5.1 compatible

Source on GitHub

WinLog Threat Hunter : analyzed 9 events, 3 finding(s)
CRITICAL: 2   HIGH: 1

[CRITICAL] Repeated failed logons (brute force / password spray), followed by success
  rule: BRUTE-001 · mitre: T1110 · who: WIN-VPN01 / 45.33.12.7
  7 failed logons in 6 min, then a success from the same source: likely compromise, not a blocked attempt.

[HIGH] Special privileges assigned following a notable interactive logon
  rule: PRIVESC-001 · mitre: T1078 · who: svc_backup / WIN-VPN01

Real output from the tool, run against its own bundled sample_logs/brute_force_attack.jsonl dataset, not staged.

Parses exported Windows Security/Sysmon events and flags brute-force logons, privilege escalation, suspicious command lines, and admin-persistence patterns, each mapped to a MITRE ATT&CK technique.

Why I built this

Raw Windows Security logs are enormous and mostly noise. I wanted practice turning that noise into named attacker behavior, mapped to ATT&CK and not just "suspicious event #4471", because that translation is most of what a threat hunter actually does.

25 tests passing MITRE ATT&CK mapped

Source on GitHub

Skills

Technical toolbox

Identity & Systems Administration

Active DirectoryAD Domain ServicesGroup PolicyWindows ServerRSATUser provisioning / offboardingPrint server administration

Endpoint & Infrastructure

SmartDeploy imagingPXE BootSCCM / MECMWorkstation deploymentLaptop / thin-client deploymentAsset inventoryPatching

Security & Compliance

Endpoint protectionLeast-privilege enforcementAccess controlHIPAA-aligned data handlingVLANsFirewall / switch troubleshooting

Scripting & Automation

PowerShellPythonBashSQLC++JavaJavaScript

Virtualization

VMwareVirtualBoxVM deploymentSnapshot management

ITSM & Tools

ServiceNowRemedyITOM / ITSM / ITBMHRSD platformsBeyondTrust / BomgarPower BIMicrosoft 365

Education & Certifications

Background

May 2026

B.S., Computer Science, Cybersecurity Focus

Liberty University, Lynchburg, VA

2021

CCAF A.A.S., Health Information Technology & Services Management

Community College of the Air Force, San Antonio, TX

CompTIA Security+ Active view certificate →
Secret Security Clearance Active, U.S. Air Force Reserve
CompTIA IT Fundamentals+ view certificate →
Microsoft Technology Associate (MTA) view certificate →
Basic Life Support (BLS) & CPR Certified
AF Continuous Process Improvement & Six Sigma Green Belt

Systems Administratorbuilding towardsecurity engineering.

Where I've been, where I'm headed

Where I've worked

IT Support Associate II, Operations Technology

IT Support Technician

IT Systems Administrator | Health Services Administrator

Organization Technology Pro | Department Manager

Selected work

Interactive Diploma

Interactive Diploma

Technical toolbox

Identity & Systems Administration

Endpoint & Infrastructure

Security & Compliance

Scripting & Automation

Virtualization

ITSM & Tools

Background

B.S., Computer Science, Cybersecurity Focus

CCAF A.A.S., Health Information Technology & Services Management