I watch industrial networks so a breach doesn't reach the physical world.

I trained as a mechatronics engineer, which means I started by learning how physical systems actually work before I ever looked at a security alert.

That background shapes how I work a SOC OT queue today. An alert on a PLC or an engineering workstation isn't just an IOC — it's tied to a process, a Purdue level, a piece of equipment that can't just be patched or rebooted like an office laptop. Useful security in industrial environments starts with understanding how the plant actually runs, not just what the sensor flagged.

Day to day, that means passive network monitoring, investigating and escalating alerts, tracking vulnerabilities against what's actually exploitable, and writing client-facing reports that hold up against ISA/IEC 62443 and MITRE ATT&CK for ICS. Increasingly, it also means building small tools — dashboards, automation, AI-assisted workflows — to make that work faster and less repetitive.