What Elvis demonstrated

Built an end-to-end incident response workflow for a phishing-to-ransomware scenario: triaged the lure, mapped the attack to kill-chain stages, investigated anomalous authentication activity, and chose a containment sequence that cut access before destructive remediation. Also drafted a concise GDPR breach notice and translated the lessons to the Continental case using public facts, including the initial shadow-IT download, four weeks of dwell time, and roughly 40 TB exfiltrated.

• Leakage-Free Incident Triage
• Evidence-Based Log Investigation
• Defensible Containment Sequencing
• Executive Security Communication