Casey Ledbetter
Illustration of Casey at a desk of monitors and server racks in a workshop that looks out over green hills. One screen reads Cyber Range.

I find the weak spots, script the fix, and show my work.

I'm Casey Ledbetter, a cybersecurity analyst working in vulnerability management, security engineering, and compliance. Before security I spent four years testing software, so I care about proof that a fix held.

See the work Resume GitHub
  • Security+, CySA+, and A+ certified
  • Tenable, Defender for Endpoint, Sentinel
  • PowerShell, Bash, Python, KQL
  • Fremont, CA

What I do

Vulnerability management
I scan with Tenable, rank findings by risk and effort, and work with the teams who own the systems so fixes land. One full cycle took a server from 30 findings to 6.
Security engineering
I automate remediation and hardening in PowerShell and Bash, and I write detection rules that isolate a compromised machine without waiting on a person. My testing background means every fix gets a rescan.
Compliance
I map systems to DISA STIG controls, script the remediation, and document the result. I also supported SOC 2 Type II audit readiness by collecting evidence and answering auditor requests.

Case studies

Three projects written up from start to finish, with the queries, scripts, and results.

online to first probe
7 min
online to data wiped
16 min
extortion crews
2
failed RDP logons
2,563

Honeypot and incident response

A live honeypot breach, from first probe to forensic comparison

I built a Windows and MySQL server, wrote the detections, then exposed it to the internet on purpose. Two crews wiped and ransomed the database within two hours, and a third actor guessed the admin password over RDP.

  • Microsoft Sentinel
  • Defender for Endpoint
  • KQL
  • MySQL
  • Azure
  • DFIR

Read the case study

Growing collections

Two repos I keep adding to as I work through new hunts and new benchmarks.

Threat hunts

Hypothesis-driven hunt reports with the queries, findings, and MITRE ATT&CK mapping for each stage.

    All threat hunts

    STIG remediations

    One script per DISA STIG control. Each one fixes the finding and is checked with a rescan.

      All STIG remediations

      Experience

      Support, then testing, then security. The full resume has the detail.

      1. Feb. 2026 to present

        Cybersecurity Analyst (Vulnerability Management and SecOps Intern)

        Log(N) Pacific

        Scanning with Tenable, writing PowerShell remediations and STIG fixes, and hunting threats in Defender for Endpoint and Sentinel.

      2. Apr. 2025 to Oct. 2026

        Integration Engineer

        NICE CXone

        Supported SOC 2 Type II audit readiness and secured authentication and API access between the knowledge platform and CRM tools.

      3. Sept. 2022 to Apr. 2025

        Software Engineer in Test

        NICE CXone

        Led a four-person team that moved more than 600 automated tests from Selenium to Playwright and wired them into Jenkins CI/CD.

      4. Mar. 2022 to Sept. 2022

        QA Engineer

        NICE CXone

        Administered AWS IAM and OneLogin for 20 engineers and cut blocking flaky tests from more than 100 to fewer than 20.

      5. Sept. 2019 to Mar. 2022

        Technical Customer Success Agent (L3 Support)

        MindTouch / NICE CXone

        L3 escalation point for outages, with root-cause analysis in Splunk and Datadog and SAML SSO fixes in Okta and OneLogin.

      Certifications and education

      Certifications

      • CompTIA CySA+Feb. 2026
      • CompTIA A+Jun. 2026
      • CompTIA Security+Aug. 2023

      Education

      • B.S. Cybersecurity and Information Assurance, Western Governors UniversityExpected Apr. 2027
      • A.S. Cybersecurity, San Diego City College

      Web projects

      Small tools I build and run, each at its own address on this domain.

      1. first-project.caseyledbetter.com

        The first one is being built. It will show up here with a working link.