Skip to content

Security engineer · SIEM and API · United Kingdom

SIEM, APIs and the parsers between.

At CrowdStrike I onboard and parse customer data for Falcon Next-Gen SIEM. Outside work I build open-source tools.

View experienceEmail me

Open to the right role

Technical Support Engineer (API/SIEM) at CrowdStrike

Lens: events parsed0/46

01/Career

8 years from first-line IT to SIEM engineering.

  • Remote

    Engineering support for Falcon Next-Gen SIEM, Falcon LogScale and the Falcon API across enterprise customers. Onboard data sources and troubleshoot connectors, Falcon Log Collector and log-shipping pipelines. Write and debug parsers against the CrowdStrike Parsing Standard (CPS) and ECS. Build and fix correlation rules, scheduled searches and Fusion SOAR workflows. Resolve API cases covering OAuth2, client scopes, regional endpoints and rate limits. Write KB articles, raise defects with engineering, and mentor new starters.

    • Falcon Next-Gen SIEM
    • LogScale / CQL
    • Falcon API
    • FalconPy
    • Fusion SOAR
    • CPS / ECS

  • Homelab / Remote

    Co-founded an open-source group building self-hosted replacements for data-harvesting third-party services (link shortening, file transfer, media management), run as containers on our own Proxmox and Docker homelab. Flagship projects ListSync and SeerrBridge have 500+ GitHub stars and 80.3K Docker pulls on ghcr.io.

    • Python
    • Docker
    • Vue
    • FastAPI
    • Proxmox
    • ghcr.io

  • Stevenage · Hybrid

    Led SIEM/SOC implementations from scoping through to a working integration for each client. Resolved Tier 2 issues across Kafka and Elasticsearch, supported sales on technical scoping, and worked with the SOC and engineering on R&D. Maintained firewall updates and SIEM install packages through GitLab CI/CD.

    • Kafka
    • Elasticsearch
    • Logstash
    • Kibana
    • GitLab CI/CD
    • Docker

  • Stevenage

    Managed £2.5M of penetration-testing delivery across infrastructure, web and API, social engineering and red-team engagements. Supported clients with SIEM and DPO integrations, vulnerability assessments and training, from kick-off through to report.

    • Elastic SIEM
    • Burp Suite
    • Metasploit
    • Nessus
    • Kali Linux
    • Jira

    • Bishop's Stortford

      Technical support by phone, email, live chat and in person for customers, UK service agents and staff, across 25+ electric trolley models and 30 accessories. Owned cases end to end with minimal escalation.

      • Phone
      • Email
      • Live chat

    • Bedfordshire

      1st and 2nd line support: hardware and software troubleshooting, Active Directory for pupil accounts, and imaging and deployment of iPads and Chromebooks for remote learning. Worked to SLA and KPI targets.

      • Active Directory
      • G-Suite Admin
      • Avast
      • Sophos

    • Cuffley

      1st line IT support, Active Directory onboarding and offboarding, and hardware imaging and configuration. Cut average ticket resolution time by 20% using ConnectWise and stricter triage.

      • ConnectWise
      • SCCM
      • Active Directory
      • Webroot

Certifications8 listed

  • CompTIA A+CompTIA2019Expired 2022
  • MTA: Cloud FundamentalsMicrosoft2019
  • MTA: Mobility and Device FundamentalsMicrosoft2019
  • Business ProcessesBCS2019
  • Coding and LogicBCS
  • Engineer TechnicianConnectWise2019
  • Internal ITConnectWise2019
  • Conversational Support ExpertIntercom2022

02/Selected work

Open-source tools other people run.

01 / 03

ListSync

GitHub Stars
300+
Docker Pulls
80.3K
  • Python
  • Docker
  • Vue 3
  • FastAPI
  • Open Source
GitHubContainer
ListSync dashboard

  1. 1Problem

    Watchlists lived in IMDb, Trakt and Letterboxd. Media requests lived in Overseerr. Nothing connected them.

  2. 2Build

    Python sync engine, FastAPI REST API and Vue 3 dashboard, packaged as one container.

  3. 3Result

    300+ GitHub stars and 80.3K Docker pulls from ghcr.io.

Syncs watchlists from IMDb, Trakt, Letterboxd and other sources into Overseerr or Jellyseerr on a schedule. A Python sync engine, FastAPI REST API and Vue 3 dashboard, shipped as a single container on ghcr.io. Started as a fix for my own setup and now has an active user community.

02 / 03

CopyCat

GitHub Stars
30+
Downloads
462
  • Nuxt
  • FastAPI
  • Vue
  • Python
  • Docker
GitHubContainer
CopyCat dashboard

  1. 1Problem

    Moving media from Zurg and Rclone mounts onto local storage meant remoting in and copying folders by hand.

  2. 2Build

    Nuxt front end over a FastAPI service with Trakt/TMDB metadata matching and a copy queue.

  3. 3Result

    30+ GitHub stars and 462 downloads for a deliberately niche tool.

Self-hosted media manager that moves content from cloud mounts (Zurg, Rclone) to local disks and NAS. A Nuxt UI over a FastAPI service scans libraries, matches metadata through Trakt and TMDB, and queues streaming copies. Built for my 300TB homelab.

03 / 03

Telegram Copy Paste

GitHub Stars
25+
Downloads
35+
  • Python
  • Telethon
  • Telegram API
GitHub
Telegram Copy Paste terminal

  1. 1Problem

    Messages had to be copied between chats by keyword, by hand, all day.

  2. 2Build

    Telethon bot with keyword filters, blacklists, signatures, multi-chat profiles and encrypted credentials.

  3. 3Result

    25+ GitHub stars and forks from people running the same workflow.

Python bot built on Telethon that forwards messages between Telegram chats using keyword filters, blacklists and custom signatures. Supports multiple source and destination chats, saved profiles and encrypted credential storage.

MergedUpstream contribution

Navidrome Discord Rich Presence

View PR

Merged into Navidrome's Discord Rich Presence plugin (Go, compiled to WASM). Added click-through Spotify links on track, artist and album art, resolved through the ListenBrainz Labs API with an MBID lookup, metadata and search fallbacks, and cached results. Also added a Navidrome logo overlay on album art. The maintainers built on the PR and shipped it in main.

Commits
19
Lines Changed
+884 / -195
PR Status
Merged

03/About

What I bring to a security team.

I work between a customer's raw data and a working detection: ingestion, parsing, normalisation, and the APIs that move it.

Security engineer based in the UK, currently a Technical Support Engineer (API/SIEM) at CrowdStrike. I work across Falcon Next-Gen SIEM, LogScale and the Falcon API: data onboarding, parser development against CPS and ECS, correlation rules, Fusion SOAR workflows and OAuth2 API integrations.

Before CrowdStrike I ran SIEM/SOC implementations at Defense.com on Kafka, Elasticsearch and Logstash, and managed £2.5M of penetration-testing delivery at Bulletproof. I started in first-line IT in 2018.

Outside work I co-founded WoahAI, which builds open-source self-hosted tools, and run a 300TB Proxmox and Docker homelab where they are built and tested.

8
Years in Tech
£2.5M
Pentest Delivery Managed
500+
GitHub Stars

Stack34 indexed

Security and SIEMIngestion, parsing, detection, testing

  • Falcon Next-Gen SIEM
  • LogScale / CQL
  • Falcon API
  • Fusion SOAR
  • CPS / ECS parsing
  • Elastic SIEM
  • Kafka
  • Burp Suite
  • Nessus

DevelopmentPython services and web front ends

  • Python
  • JavaScript
  • TypeScript
  • Vue / Nuxt
  • React
  • Next.js
  • Node.js
  • FastAPI
  • HTML & CSS

InfrastructureCloud, containers, Linux

  • Docker
  • Kubernetes
  • AWS
  • Azure
  • GCP
  • GitLab CI/CD
  • Linux
  • Proxmox

ToolingData stores and delivery

  • Git / GitHub
  • GitLab
  • Jira / Confluence
  • PostgreSQL
  • MongoDB
  • Active Directory
  • Selenium
  • Tailwind CSS

Homelab

300TB

Proxmox and Docker on 300TB of storage. Where the open-source tools are built and tested.

Open to the right role

  • SIEM and detection engineering
  • Security engineering
  • Solutions and integration engineering

Remote-first. Open to hybrid in the South East.

Talk about a role

04/Contact

Hiring for SIEM, detection or security engineering?

Open to roles in SIEM and detection engineering, security engineering, and solutions or integration engineering. Remote-first, open to hybrid in the South East. Happy to talk open source or homelab too.

aidan@hub22.uk
What's this about?

No tracking. Goes straight to my inbox.

Esc

Go to

Actions

Elsewhere

LinkedIn↗GitHub↗X (Twitter)↗ListSync on GitHub↗CopyCat on GitHub↗Telegram Copy Paste on GitHub↗
↑↓ move↵ run