Hi, Iām Lee
Iām an IT Security Officer based in Manila. I began my security journey as a Threat Response Engineer, analyzing Windows and macOS binaries down to the bits and bytes. Over time, I moved into Incident Response, where I analyze files submitted by customers and investigate potential compromises. If we find malicious files that our detection missed, I help create and push patches to detect them, and I also develop smart signatures to improve detection coverage.
I now dedicate my time to Detection Engineering, primarily on automation projects that help my organization improve its detection and response capabilities against the ever evolving threat landscape.
I created this site to maintain a personal technical blog and share security topics that I find particularly interesting. Be sure to check out my latest post
here
.
Outside of cybersecurity, I'm an avid reader, fitness enthusiast, novice photographer and InfoSec student.
My Background
š¼ Work Experience
-
Asian Development Bank
Associate IT Officer (Technical Security)
July 2025 ā PresentDeception Technology- Led the implementation of a new deception platform across the organization.
- Migrated existing rules, policies, and configurations from the legacy solution to the new platform.
- Led compatibility and functionality testing across multiple device types.
- Ensured all organizational requirements were met before production go-live.
- Connected the platform to existing security tools to extend visibility.
- Monitor and respond to incidents generated by the deception platform.
Infrastructure Administration- Administer the organization's EDR platform, including policy and agent management.
- Track agent releases and coordinate upgrade schedules with affected teams.
- Serve as the primary point of contact for endpoint detections and data requests.
- Led the export of EDR telemetry for long-term archiving and retention.
- Built automation to streamline monitoring and auditing of security groups.
- Verify the health of integrations across the security tool stack.
Application Control- Investigate blocked executions to determine true or false positives.
- Collaborate with multiple teams to validate detections and refine policies.
- Keep agents current and manage rollouts when updates are required.
- Review agent coverage to ensure no endpoints are left unprotected.
AI Security- Led proofs of concept for browser-based and gateway AI monitoring solutions.
- Supported the deployment of the selected solution.
- Triage and validate detected AI usage policy violations.
- Create custom detections and rules for AI-related risks.
Quality Assurance / Incident Handling- Audit closed incidents to confirm the accuracy of final verdicts.
- Recommend workflow improvements to increase SOC efficiency.
- Reopen and escalate incorrectly closed incidents for proper resolution.
- Compile findings into reports and present them to the team.
SaaS Security- Led the deployment of the SaaS Security Platform and continue to maintain it.
- Onboarded existing and critical SaaS applications into the platform.
- Evaluated policies and performed baseline testing to validate effectiveness.
- Analyzed SaaS API documentation to enhance detections and develop new rules.
- Linked the platform to other security tools for unified monitoring.
Email Security- Review detections from the email security solution to confirm accuracy.
- Remediate misclassified emails, including false positives and missed threats.
- Resolve user and team inquiries related to email security.
Threat Awareness & Vulnerability Response- Follow threat intelligence and security news to stay informed on emerging attacks.
- Assess asset exposure to newly disclosed threats and initiate remediation when needed.
Time Server Deployment- Oversaw the rollout of a new NTP time server.
- Configured the server to align with organizational requirements.
- Identified and redirected time-sync traffic from the legacy server to the new one.
- Coordinated with multiple teams to ensure a seamless cutover with minimal disruption.
Dashboard Creation- Designed custom dashboards tailored to SOC team workflows.
- Integrated dashboards with Microsoft Sentinel to reflect alerts in real time.
- Incorporated geographic map visualizations to display incident origins and locations.
Project Management & Documentation- Prepare required documentation for third-party vendor engagements.
- Manage change requests across multiple concurrent projects.
- Maintain the team wiki with procedures, task records, and reference information.
IT Security Analyst (via Talentium Inc.)
Aug 2022 ā July 2025 ā¢ 3 yearsAutomation- Performs automation of routine cyber hygiene tasks using API calls, Power Automate, Python and other automation languages.
- Updates and maintains CMDB asset information. Assists on adding new devices and service mappings through automation.
- Creates custom Power Automate flows (Desktop and Web) to meet specific needs of the team.
- Develops Ansible Playbooks to automate the management of security application across various environments.
Software Management- Creates and deploys PowerShell scripts to workstations to detect and remove unauthorized software.
- Investigate into workstation processes using Advanced Hunting in Defender XDR and CrowdStrike Advanced Event Search to verify any unauthorized software installations.
- Performs research of vulnerable hashes to block in CrowdStrike Application Blocking.
- Performs removal of unauthorized software using CrowdStrike RTR.
- Creates scripts to retrieve all installed browser extensions and generate a working inventory.
- Creates registry files to deploy browser extension whitelisting.
- Tests business applications in PowerApps and reports any found security gaps.
Integrations- Implements integrations in ServiceNow using the Service Graph Connector, Business Script, Script Include and Email Inbound Action to automate actions and ensure seamless data flow between different systems such as CrowdStrike, Defender, Intune, Genetec and Nessus.
- Use PowerShell to call the KnowBe4 API and retrieve training data for reporting.
- Extract data from Microsoft Purview to connect and visualize it in a custom dashboard.
Baseline- Perform baseline scans on Linux and Windows devices.
- Modify configuration to fit ADB environment and standards.
- Create and maintain scan groups and schedule scans to ensure regular outputs.
- Review baseline scans and recommend remediation to administrators for failed results.
-
Trend Micro
2 years 8 monthsMac TRT Engineer
Nov 2021 ā Aug 2022 ā¢ 10 months- Provides timely detection of Mac threats.
- Creates signature-based patterns/rules to detect specific strains of Mac malware family.
- Developed a basic knowledge on Mac OS internals and Mach-O binaries structure.
- Continuously collaborate with other members by creating and presenting virus reports of notable Mac malware.
- Created a macOS image in Virtual Machine with tools such as MachOView, IDA Pro, FSMonitor, Hopper, KnockKnock and Netiquette for analysis of Mach-O binaries.
Threat Response Engineer - File Detection Service
Aug 2020 ā Aug 2022 ā¢ 2 years 1 month- Provides in-depth analysis of files submitted by our customers including viruses, worms, trojans, and spyware.
- Creates signature-based patterns/rules to detect specific strains of a malware family.
- Handle infection cases that require identification of malicious objects, registry entries, Windows Management Instrumentation (WMI) and scheduled tasks on customers' environment to quickly fix/clean the system.
- Performs reverse engineering and analysis of files to determine whether they are non-malicious, grayware or malware.
- Provides bandage patterns for immediate cleaning solution to address any system infection cause by a specific malware.
- Informs our customers about best practices to keep their systems safe from malware attacks.
- Provides quality response to queries and malware related concerns of customers via system/email.
- Became familiar with notable behaviors of various malware families.
- Apply technical skills to analyze files and related components using tools such as Virtual Machines, OllyDbg, Systracer, unpackers, hex editor and network sniffers.
Threat Experts University - Trainee
Jan 2020 ā Aug 2020 ā¢ 8 monthsThe training program aims to provide trainees with an in-depth understanding of cybersecurity. The training course contains the following topics:
- Introduction to Reverse Engineering and Familiarization with Assembly Language.
- Different types of Malware Threats (Viruses, Worm, Backdoor, TrojanSpy, Exploits and Ransomware) and their typical behavior indicators.
- Decompiling and unpacking of binary files (C++, Delphi, Visual Basic and C#).
- Script Malware Analysis (JS, VB and Powershell scripts) and how to deobfuscate them.
- Analyzing fileless infections and macro codes.
- File Verification and creating technical virus reports.
- Network Traffic Analysis (TCP Communication, Packet Sniffing, Reconnaissance, etc) and Network Security Threats (DDoS, SQL injection, Cross-site Scripting, etc).
- URL and Email Analysis (SMTP commands, Email headers analysis, Web Threats, Redirectors, etc).
- Understanding the Contextual Threat Intelligence Framework (Cyber Kill Chain, Diamond Model and how to use MITRE ATT&CK Framework).
-
DICT Philippines
Internship Trainee
Apr 2018 ā May 2018 ā¢ 2 months- Monitor network access points every two hours and log alarms with time and date.
- Identify the causes of outages such as connectivity loss, disabled repeaters, or power issues.
- Use Cisco Meraki Dashboard to analyze and troubleshoot network problems.
š Education
-
De La Salle University
Master of Science in Information Security
Manila, Philippines 2023 - Present -
Technological University of the Philippines
Bachelor of Science in Electronics Engineering
Manila, Philippines 2013 - 2019
š Certifications
Blue Team Level 1 Security Blue Team
Issued Oct 2025
Certified in Cybersecurity ISC2
Issued Mar 2023
CompTIA Security+ CompTIA
Issued Jul 2021
š„ļø Virtual Labs
Note: Write-ups will be published once the box is retired.
š Awards
Wiki Enhancement
ADB - ITD
Aug 2026
Champion
Departmental
Datadog Dashboard Contest
ADB - ITD
Oct 2023
Champion
Departmental
Devlympics (Cloud) Ansible
Secure Code Warrior
Oct 2022
Champion
International
š ļø Skills
Malware Analysis
IDA Pro OllyDbg PEStudio Detect It Easy
Automation & Scripting
Python API PowerShell Perl VBS C++
Threat Intelligence & Hunting
MISP VirusTotal AbuseIPDB
SIEM / Endpoint Detection & Response
CrowdStrike Falcon Sentinel Microsoft Defender Splunk Airlock
Email Security
Abnormal Security KnowBe4
Offensive Security
Kali Linux
Forensics
Autopsy FTK Imager Volatility Cyber Triage Wireshark