Senior Cyber Risk Management Analyst focused on vulnerability and exposure management, threat-informed prioritization, and AI-assisted security workflows.
Tracking IPs flagged by public blocklists. Hover or tap a blob for its card.
Real data: 40 of the most-flagged IPs out of 144,310 in the IPsum feed for November 7, 2026, placed by country with ip-location-db. IPs are masked. Updated daily, not a live feed.
01about
I work in cyber risk management, with a focus on vulnerability and exposure management. The work is turning scanner output into decisions people can act on: validate each finding before it reaches an engineer, rank it by exploitability, exposure and business impact rather than CVSS alone, and follow it through to remediation.
I came to risk management from operations. More than five years across SOC monitoring, vulnerability management and infrastructure security taught me how a finding looks from both sides of the ticket. It shapes how I approach GRC and third-party risk: a control, or a vendor’s attestation, is only as strong as the evidence behind it.
01
Confirm a finding is real, reachable and correctly versioned before it becomes an engineer’s ticket.
02
Threat-informed prioritization: exploitation evidence, exposure and business criticality decide the order, not CVSS alone.
03
Automation and AI-assisted triage take the repetitive work out of the queue. A human signs off on every decision.
04
Root-cause fixes and team training, so repeat findings stop coming back.
Each cell is a scenario from day-to-day risk work, placed by likelihood and impact. Pick one to see how I handle it and where the work lives on this site: a case study, a post, a skill or a point in my timeline.
Scenario
How I handle it
Confirm exposure, confirm the fix path, and push for remediation inside days or a documented compensating control. This is the top tier of my prioritization model.
02services
03selected work
Three pieces that show how I approach cyber risk: a prioritization framework, a triage workflow and a threat analysis. Each has a full case study covering the problem, what I did and the outcome.
A scoring model that ranks findings by exposure, exploitation evidence and business criticality, so remediation effort goes where the risk is instead of where the CVSS score is highest.
Example: VPN appliance
CVSS aloneone signal of many
TierAct now
A Python and LLM pipeline that validates, groups and explains findings before they become tickets, with a human approving every decision.
Five old CVEs, one three-day deadline, four forensic triage flags. How I turned CISA's October 8, 2026 KEV update into an ordered, asset-level response plan.
Added Oct 8, 2026due Oct 11
04writing
KEV analyses, prioritization notes and lab write-ups. This is where I work things out in public, starting with what CISA’s Known Exploited Vulnerabilities catalog says about where to look first.
Since CISA's BOD 26-04 took effect, 82% of new KEV entries carry a three-day remediation window. A look at every addition from June 11 to October 16, 2026, what changed, and which product classes keep landing on the short clock.
CISA added five CVEs from 2015 to 2023 to the KEV catalog on October 8, 2026, tied to activity consistent with Flax Typhoon. What each one is, why four are flagged for forensic triage, and how I would work the batch.
131 KEV additions
June 11, 2026 to October 16, 2026
By product class (3-day share in red)
Source: CISA KEV catalog v2026.10.16, verified October 17, 2026.
Real data, not a live feed.
05timeline
From SOC operations and vulnerability management to cyber risk management. Most recent first.
2026
Texas Capital Bank / January 2026 to present
Vulnerability and exposure management. I validate findings before they reach engineers, prioritize them by exploitability and business risk instead of CVSS alone, automate the repetitive work in Python, run AI-assisted triage, and train teams so repeat findings stop coming back. I also governed a third-party AI offensive-validation capability (Wiz Red Agent), including vendor methodology review, data isolation assessment and pilot approval support. Earned the ISACA CRISC certification the same year.
2025
Oculus IT, Irving, TX / 2025 to 2026
Managed 1,200+ endpoints, contained ransomware on a campus camera server, supported an Azure migration and deployed 55+ wireless access points. Completed the MSc in Cybersecurity and the ArcX Cyber Threat Intelligence 101 course the same year.
2024
University of Dallas
Earned CompTIA Security+ and AWS Solutions Architect Associate while studying for the MSc in Cybersecurity and continuing in the IT security role.
2023
University of Dallas / 2023 to 2025
Secured remote connectivity with GlobalProtect, migrated PKI infrastructure, and implemented Azure Firewall segmentation across academic and administrative networks.
2022
Standard User Cybersecurity, Denton, TX / 2022 to 2023
Led weekly vulnerability assessments with Nessus and Qualys and coordinated remediation with DevOps teams across cloud and on-prem environments.
2021
Standard User Cybersecurity, Denton, TX / 2021 to 2022
Real-time threat monitoring in Wazuh and Splunk. Built Python automation for log parsing to speed up forensic investigations.
06stack
The platforms I work in, the frameworks I map risk to for GRC and third-party risk, and the credentials behind them.
07contact
Open to full-time roles and consulting in cyber risk management: vulnerability prioritization, GRC, third-party risk, KEV response and AI triage.
Dallas, TX. Remote or hybrid.
moss@mosslab.me