About Me

I'm Josh, also known as WhiteRqbbit. I'm a SOC analyst. I spend my days triaging endpoint, cloud, and network detections, mostly in CrowdStrike Falcon, Splunk ES, and Wiz.

I got here the long way. No Computer Science degree, no help desk job to start from. I spent four years in the Marine Corps and close to a decade in facilities and building engineering before I moved into security, working on the degree and the certifications while I held down the day job. I finished my B.S. in Cybersecurity at the SANS Technology Institute in January 2025, and I hold nine GIAC certifications (GCIA, GCIH, GCFA, GCFE, GSEC, GRID, GPYC, GFACT, and GISF) along with BTL1, which was my first.

The indirect route turned out to be an advantage more often than a handicap. Troubleshooting a building system and working an alert queue are closer than they sound: both reward curiosity, both punish assumptions, and in both the interesting part is working out what is actually happening versus what the indicator says is happening.

What I write here is mostly the work itself: detections I found interesting enough to take apart, tools I built because the thing I needed did not exist, and the occasional note on exams or on breaking into the field for anyone taking a similarly indirect route. I publish my tooling on GitHub.

If you want to talk shop, ask about the path, or have an opportunity worth discussing, reach me at IamJoshGilman@gmail.com.