Joe Whittle · Security engineer

1About

A note on the domain. I was born Andrey Kontarev Sergeevich, in Ukraine. In 1998, when I was three, I was adopted and renamed Joseph Whittle. So the site lives at the name I started with, and the person on it goes by Joe. The rest of the story is better over coffee — say hello.

I was an infantry team leader in the U.S. Army from 2015 to 2017. In 2018 I took an IT associate job at FloSports in Austin, looking after 500-plus endpoints. Two years later I was building and running the company's network, and the year after that I moved into security, where I stayed until 2025. Since then I've worked contracts: security automation at Arctiq, and now information security at a healthcare technology company.

At FloSports I owned identity and access for 150+ applications, ran detection and response, and led CIS 18 adoption from no formal controls. At Arctiq I built SOAR playbooks and the telemetry pipelines feeding Google Chronicle for MSSP alert triage.

2Work

Newest first, grouped by type of work.

Security 2021 to now

Current

Information Security Engineer · Healthcare technology company (contract)

Oct 2025 – Jan 2026

Security Automation Engineer (Contract) · Arctiq

Built and tuned SOAR playbooks integrated with Splunk SIEM and Google Chronicle, taking in telemetry from Microsoft Entra ID / Azure IAM, CrowdStrike, and a long list of EDR/EDM platforms for MSSP alert triage and response.
Ran and automated the telemetry pipelines that fed Entra ID and EDR data into Chronicle, normalizing ingestion and enrichment across multi-tenant client environments.
Worked with the security operations teams to standardize detection-and-response runbooks and incident response procedures across clients.

Mar 2021 – May 2025

Security Engineer · FloSports, Austin

Owned identity and access in Okta and Microsoft Entra ID across 150+ applications: joiner-mover-leaver workflows and least-privilege guardrails.
Led detection and response with Splunk SIEM and CrowdStrike EDR. Triaged 50+ cloud-based incidents, tuned detections to cut false positives, and brought MTTR down about 40%.
Wrote Python and SQL automation for alert enrichment and response, which saved roughly 20 hours a week of manual work.
Ran CVSS-based vulnerability remediation with engineering and held a 98% SLA closure rate on high-severity findings.
Found a DSAR backlog of 270 to 360 days against a 45-day legal obligation. Put together a task force with Legal, CS, Marketing, and Engineering, moved the process to TrustArc automation, and built one intake and response hub.
Led adoption of CIS 18 starting from no formal security controls: benchmarks, gap assessments, and a phased plan.

Systems & network 2020 to 2021

Mar 2020 – Mar 2021

IT Systems Engineer · FloSports, Austin

Designed and deployed a 40,000 sq ft Cisco-backed network for the corporate office and live production, and ran the switching, routing, and wireless end to end.
Administered the corporate network and systems: Windows and Linux environments, plus centralized monitoring.
Supported identity integration across Active Directory, Microsoft Entra ID, and Okta toward centralized access management.

IT support 2018 to 2020

Mar 2018 – Mar 2020

Information Technology Associate · FloSports, Austin

Managed lifecycle operations for 500+ endpoints across distributed environments.
End-user support and secure provisioning aligned to baseline operational controls.

Service 2015 to 2017

Apr 2015 – Dec 2017

Infantry Team Leader · United States Army

Led small teams in high-pressure operational environments.

Kit

Identity: Okta, Microsoft Entra ID (Azure AD), SSO, SCIM, RBAC, joiner-mover-leaver workflows
Detection: Splunk SIEM, Google Chronicle SIEM and SOAR (at Arctiq), CrowdStrike EDR, incident response, alert triage
Automation: Python, SQL, SOAR workflows, API integrations
Cloud: AWS IAM, CloudTrail, GuardDuty, Security Hub
Compliance: CIS Controls, GDPR and DSAR, SOC 2 alignment
Certified: CompTIA Security+, Network+, A+; AWS Cloud Practitioner; Cisco CCNA; Okta Certified Administrator

A full résumé is available on request.

3Projects

AtlasIT. A multi-tenant compliance platform that replaces manual control audits with an automated pipeline: control mapping, evidence collection, and posture reporting for organizations that don't have security staff. Tenant isolation and least-privilege API scoping are enforced at the edge. Cloudflare Workers, Hono, D1; React and TypeScript.

A Whittle Wandering. Telemetry from the 2025 road trip, ingested, normalized, and mapped. Secrets live in a vault rather than in source, ingestion is schema-validated, and logging is structured. Cloudflare Workers, D1, KV, R2; React and Mapbox.

4Work with me

I take contract work, remote. These four come up most.

Okta and Entra ID cleanup. Find out who can reach what, fix joiner-mover-leaver gaps, cut standing admin rights, and put apps behind SSO and SCIM where they support it. I've owned identity for 150+ applications.

Detection and SOAR playbooks. Tune noisy detections, write triage and response playbooks, and get the right telemetry into the SIEM. Splunk, Google Chronicle, CrowdStrike.

CIS 18 baseline. Start from where you are, including no formal controls: benchmarks, a gap assessment, and a phased plan your team can run.

Network hardening. Review switching, routing, wireless, and segmentation, then close what shouldn't be reachable. I built and ran a 40,000 sq ft Cisco network before I moved into security.

It starts with a 30-minute call to see if it fits. Then I write up the scope and deliverables before any work starts.

Book a time (opens in a new tab)

Or email howdy@andreysergeevich.me.

The 60-second version

Role: Security engineer. Contract, remote.
Path: Eight years: IT support, then systems and network, then security. Army infantry team leader before that, 2015 to 2017.
Identity: Okta and Microsoft Entra ID across 150+ applications.
Detection: Splunk, CrowdStrike, Google Chronicle SIEM and SOAR. MTTR down about 40%.
Automation: Python and SQL that saved roughly 20 hours a week of manual work.
Programs: CIS 18 adoption from no formal controls.
Certified: Security+, Network+, A+, AWS Cloud Practitioner, CCNA, Okta Certified Administrator.

5Case studies

Three past jobs, with the names left out.

CIS 18 from no formal controls

Before. An in-house security role at a company with no formal security controls.

Work. Measured where things stood against CIS 18 benchmarks, ran gap assessments, and wrote a phased plan to adopt the controls.

Result. The company had a control framework and a plan to work through it, instead of starting from nothing.

Identity for 150+ applications

Before. Access spread across Active Directory, Microsoft Entra ID, and Okta, for more than 150 applications.

Work. Integrated those directories toward central access management, built joiner-mover-leaver workflows, and set least-privilege guardrails.

Result. One identity setup I owned end to end, where access was granted and removed through defined workflows.

Chronicle and SOAR for an MSSP

Before. A managed security provider triaging alerts for many client environments, with telemetry from Entra ID, CrowdStrike, and a long list of other EDR platforms.

Work. Ran and automated the pipelines feeding that data into Google Chronicle, normalized ingestion and enrichment across tenants, and built SOAR playbooks with Splunk and Chronicle.

Result. Detection-and-response runbooks and incident response procedures standardized across clients.

6Field notes

Hardening a leaderboard for a dog game

October 2026

This site has a game, Sasha Fetch, with a weekly leaderboard. The game runs in your browser, so the browser can't be trusted with the score. Anyone can open the console and post whatever number they like. Here's what the server does about it.

Signed run tokens. When a run starts, the server hands out a token signed with HMAC-SHA256. It holds a random run ID, a seed, and the start time. A score only counts if it comes back with a valid token. Each token works once and expires after a few hours.

Sanity checks. The game can only produce points so fast. The server compares the score with the time since the token was issued and rejects anything the game couldn't have produced. Initials must be three letters, and request bodies have a size cap.

Turnstile. Posting a score goes through Cloudflare Turnstile, a bot check without puzzles. The cheap checks run first, so junk never costs a call to Turnstile.

Rate caps. Starting runs and posting scores are both capped per visitor per hour. The counter is keyed by an HMAC of the IP address with a salt that changes daily, and the counters are deleted daily. No raw IPs, no cookies, no accounts.

CSP. The page's Content Security Policy starts from default-src 'none'. Scripts load only from this site and the Turnstile origin, and nothing can frame the page.

Receipts. A winning score gets a short code derived from a signed receipt. It's printed on the certificate and listed in the hall of fame, so a certificate can be checked.

What it doesn't stop. A patient person with a script that plays at a believable pace could still get a score through. That raises the cost of cheating rather than making it impossible, which is the right trade for a weekly board about a dog.

7AtlasIT Secure

AtlasIT Secure is the name I do security and compliance work under, for Austin businesses with 5 to 50 people.

Who it's for. Dental and medical clinics and law firms getting ready for a cyber-insurance renewal or HIPAA, and startups that need SOC 2 before an enterprise deal.

How it starts. A free 15-minute external risk snapshot. I look at your business from the outside, the way an attacker would: exposed systems, email spoofing protection, accounts in known breaches, and domain basics. After that, a fixed-price assessment with a written report and what to fix first.

The work. I roll out MFA, SSO, a password manager, and managed EDR myself, alongside the IT provider you already have. Okta and SSO setup is a fixed-fee project. Ongoing work is month to month.

Talk to me. Email me or book a 30-minute call (opens in a new tab) to set up a snapshot.

Now

Updated October 2026. Work only.

Day job. Information security engineer on contract at a healthcare technology company.

Building. Small browser security tools for this site: a subnet calculator, a JWT decoder, hashing and Base64, a password strength estimate, and a response headers check. They all run in the browser and send nothing.

Writing. Field notes on how things here are built and secured. The first one covers the leaderboard.

Open to. Contract work in identity, detection and response, CIS 18, and network hardening. Work with me.

8Outside the office

Sasha swimming toward the camera in a calm, tree-lined river, ears up and tongue out, lit by low evening sun. — Fig. 2 Sasha, swimming.

What I do when I'm not working.

Water

Paddleboarding

When I'm home in Austin, I paddleboard.

Co-pilot

Sasha

Sasha is my dog, a German Shepherd and Border Collie mix. She was my co-pilot on the 2025 road trip (§5).

Annual

Colorado

Once a year a buddy and I go hiking in Colorado.

Sasha sitting on a bare dirt ridge in a tan harness, looking off to the side, with forested slopes and a range of snow-capped mountains under clouds behind her. — Fig. 5 Sasha, up on a ridge.

9The road

From June to August 2025, Sasha and I drove about 18,400 miles through all 48 contiguous states. The map, the numbers, and the stories are at A Whittle Wandering.

10Contact

howdy@andreysergeevich.me

Email is best. You can also book a 30-minute call, or find me on LinkedIn.

End of JW-1.