Skills
Threat Modeling (STRIDE, MITRE ATT&CK, Attack Trees, Cyber Kill Chain) · Risk Assessment · CVE/CVSS Analysis · Vulnerability Management · Responsible Disclosure · Cloud Security · CI/CD Security · RBAC · CAN/DGSI 111-1:2024 · ArchiMate 3.2 · Technical Writing · Mentoring
About
My security background was built in graduate school, where I applied the methods professional security teams use to a real, high-stakes system. For my Master of Engineering Science in Cybersecurity at Western University (NSERC-supported), I carried out a threat and risk assessment of the cloud-hosted infrastructure behind the 2024 Nova Scotia municipal online election.
I began by reconstructing the system's architecture from public evidence, then mapped its attack surface and tied known vulnerabilities (CVEs) to specific components. I scored each with CVSS and prioritized by severity, covering issues from remote code execution and denial of service to cross-protocol TLS attacks and hardware-level flaws. To reason about how weaknesses could be chained, I used four complementary threat-modeling frameworks: STRIDE to categorize threats, MITRE ATT&CK to map adversary tactics and techniques, attack trees to break attacker goals into steps, and the Cyber Kill Chain to model the stages of an intrusion. I then evaluated the system's controls against the CAN/DGSI 111-1:2024 standard, judging real practices against a formal framework rather than simply listing flaws.
The work had real-world impact. Our responsible disclosure led to 17 patches within four days, which required communicating risk clearly and prioritizing what mattered most. As first author, I wrote "On Vulnerabilities in the 2024 Nova Scotia Municipal Election," accepted to the 11th Workshop on Advances in Secure Electronic Voting at Financial Cryptography and Data Security 2026.
I've also worked in industry, as a technical analyst at BMO Financial Group and a DevOps analyst at President's Choice Financial. Those roles gave me hands-on exposure to CI/CD pipeline security, role-based access control, and architecture documentation in regulated financial environments, so I bring both research depth and practical experience. I am currently pursuing my CompTIA Security+ certification.
Profile Photo
