tsora-pop
Principal Cybersecurity Analyst · Raleigh–Durham, NC

Thomas
Gorman

I started my career listening for submarines as a Navy sonar tech. Now I listen for intruders: endpoint defense, detection, incident response, and audit.

See my work GitHub LinkedIn
16 yrs
in defense, Navy sonar to enterprise blue team
11
GIAC and ISACA certifications
M.S.
Information Security Engineering, SANS
3
National Cyber League seasons, 2023–2025
About

Blue teamer. Former auditor.

Blue · defense
Green · management
Gray · policy, risk, compliance
Orange · development
Red · security testing

I'm a Principal Cybersecurity Analyst on Fidelity Investments' Endpoint Security Operations team. I tune EDR and antivirus suites so endpoints stay hardened without grinding to a halt, and I push policy through Group Policy, Intune, JAMF, and a lot of PowerShell.

Before that I audited the same kind of controls I now build. A year as an IT Audit Manager taught me how risk gets measured, which makes me better at closing it. Earlier stops include running a SOC across three continents at SilverSky, threat hunting at Sophos, and writing ATT&CK-mapped detections at Walmart.

Outside the day job I build tools that protect people who can't protect themselves, starting with my grandparents.

Projects

Things I've built

Chrome extension · v2.1

Grandma's Guardian

An anti-scam browser extension for elderly and vulnerable users. It began as my master's thesis at SANS and is now published on the Chrome Web Store.

It works the way a firewall should: deny by default. A trusted helper maintains the lists, and the extension enforces them quietly.

  • Domain allowlisting, so unknown sites never load
  • Download filtering by file type, blocking the installers scammers rely on
  • Hides common scam phrases on the page
  • Lists load locally or from a URL, so family can manage them remotely
Chrome Web Store ↗ Source on GitHub ↗ grandmasguardian.com ↗
Open source

Atomic Red Team

Contributed tests to Red Canary's library of small, portable attack simulations mapped to MITRE ATT&CK.

Project ↗
Competition

National Cyber League

Competed in the Fall 2023, Spring 2024, and Spring 2025 seasons of NCL's offensive and defensive challenges.

Archive

Arctic Code Vault

Code preserved in GitHub's 2020 Arctic Code Vault. Everything else lives in my repositories.

Repositories ↗
Experience

Watch log

  1. Fidelity Investments

    Durham, NC · 2022–present
    Jan 2025 – now

    Principal Cybersecurity Analyst

    Lead endpoint hardening and cross-platform control parity projects across Endpoint Security Operations. Enforce application control and host firewall policies; enabled SmartScreen, network protection, and Attack Surface Reduction (ASR) rules in block mode with zero operational disruption. Proactively direct macro Trust Center reduction efforts, monitor agent performance, lead audit evidence remediation, and mentor analysts on query-based detections (KQL) and change management.

    Jul 2023 – Dec 2024

    Senior Cybersecurity Analyst

    Hardened enterprise endpoints using GPO, Intune, JAMF, and EDR platforms, balancing aggressive protection against agent performance and selective exclusions. Developed custom PowerShell log collection tools in month one and remediation workflows for internal and third-party security assessments.

    Jun 2022 – Jul 2023

    Internal IT Audit Manager

    Audited Enterprise Technology business units across Cybersecurity, Cloud, and Infrastructure domains. Developed risk-control matrices, conducted workpaper testing, reported control deficiencies to senior leadership, and mentored cybersecurity co-ops.

  2. SilverSky

    Morrisville, NC · 2021–2022
    Jan – Jun 2022

    Security Operations Center Manager

    Directed daily US SOC operations while coordinating 24/7 handoffs with teams in Belfast and Manila. Onboarded customer environments via SIEM collector integrations and API credentials, verified threat detection coverage, and delivered baseline hardening recommendations that cut incoming incident volume.

    Jul 2021 – Jan 2022

    Security Operations Center Team Lead

    Primary escalation point for SOC tier analysts. Led detection tuning, root-cause investigations, customer incident reporting, vendor product demos, analyst hiring interviews, and rapid notification of critical customer vulnerabilities.

  3. Sophos

    Carmel, IN · 2020–2021
    Sep 2020 – Feb 2021

    Threat Analyst II

    Provided proactive threat hunting, incident investigation, and containment in customer environments using Sophos MTR and Central. Overhauled the fleet Health Check process, reducing execution time from 45 minutes down to 10 minutes while delivering actionable risk-reduction guidance.

  4. Walmart

    Bentonville, AR · 2018–2020
    Feb – Sep 2020

    Senior Intrusion Analyst

    Engineered ATT&CK-mapped EDR detections, hunted threats alongside Microsoft DART, contributed test simulations to Atomic Red Team, and backed up shift leads during critical incidents.

    Jan 2018 – Feb 2020

    Intrusion Analyst III

    Monitored parent enterprise and M&A networks using SIEM, signature IDS, and endpoint security tooling. Executed initial containment before escalation to incident response; served as backup night shift lead from August 2018.

  5. Virginia Information Technologies Agency

    Chester, VA · 2016–2017
    May 2016 – Aug 2017

    Incident Response Specialist Intern

    Maintained digital forensics lab hardware and diagnostic servers; assisted in physical CentOS migrations and honeypot infrastructure. Forwarded threat correlation telemetry to SIEM dashboards and upgraded JavaScript geolocation mapping tools for SOC analysts.

  6. Virginia Commonwealth University

    Richmond, VA · 2014–2017
    Jan – May 2017

    Network Technician III

    Trained incoming technicians, drafted standard operating procedures for baseline OS imaging on Dell workstations, and managed university hardware surplus lifecycle logistics.

    Apr 2014 – Jan 2017

    Network Technician I

    Delivered tier-1 hardware, software, and networking support across the School of Humanities and Sciences. Configured 16+ computer labs, resolved low-level BIOS/driver faults, and supported remote troubleshooting.

  7. U.S. Navy

    Norfolk, VA · 2010–2014
    Jan 2010 – Jan 2014

    Sonar Technician Third Class (STG3)

    Active duty acoustic data analysis, sensor operation, and underwater warfare defense, followed by Individual Ready Reserve through 2017. Awarded Navy Achievement Medal and Enlisted Surface Warfare Specialist (ESWS).

Credentials

Certifications

GIACGSECSecurity Essentials
GIACGCIHCertified Incident Handler
GIACGCIACertified Intrusion Analyst
GIACGMONContinuous Monitoring
GIACGRIDResponse and Industrial Defense
GIACGDSADefensible Security Architect
GIACGCCCCritical Controls Certification
GIACGSLCSecurity Leadership
GIACGSTRTStrategic Planning, Policy, and Leadership
ISACACISACertified Information Systems Auditor
ISACACISMCertified Information Security Manager
MITREMAD CTIATT&CK Cyber Threat Intelligence
Education
  • M.S., Information Security EngineeringSANS Technology Institute · 2025
  • B.S., Information SystemsVirginia Commonwealth University · 2017
Service & Recognition
  • Navy Achievement MedalU.S. Navy · 2013
  • Enlisted Surface Warfare Specialist (ESWS)U.S. Navy · 2011
Toolkit

What I work with

Endpoint & management

Microsoft Defender for EndpointMicrosoft IntuneGroup PolicyJAMFSophos Intercept XosqueryTaniumMcAfee ePO

SIEM & detection

ElasticArcSightMicrosoft SentinelFortiSIEMSplunkSnortSuricata

Network

WiresharkpfSenseUniFiPalo Alto NGFWTippingPointNetWitness

Languages & query

PowerShellKQLSQLRegexBashJavaScriptC#Rust

Cloud

Microsoft AzureSophos CentralAWS

Audit, GRC & testing

Risk-control matricesArcher GRCMITRE ATT&CKBurp SuiteNmapFTK Imager
Writing

From the blog

Contact

Get in touch

Questions about Grandma's Guardian, endpoint hardening, or audit readiness are welcome.

GitHub ↗ LinkedIn ↗ X / Twitter ↗