MATT::KEITH

Technology Services Manager · Raleigh, NC · Relocating to NYC

I build security tools and AI systems that run in production.

I'm the Technology Services Manager at the North Carolina Association of County Commissioners. I design, ship and operate software our staff depend on, and I'm the primary contact for day-to-day IT needs.

Try a live labResume (PDF)GitHub
100NC counties served
4,300+contacts in County Connect
~80staff supported
143tests across 3 public CLIs

Run my tools right here

These labs use the rules and engines from the real tools, with no sign-in. They run entirely in your browser, and their results are tested against the command-line versions.

Credential security

Portcullis

Paste code or a config file and find exposed AWS keys, tokens and passwords. Matches are redacted, and a content security policy blocks network requests.

  • 20 rules
  • Entropy checks
  • T1552
Scan some text →

Detection engineering

EVTXplorer

Run brute-force, log-clearing and lateral-movement detections on sample attack logs or your own exported XML.

  • 21 rules
  • 18 ATT&CK techniques
  • Thresholds
Analyze a log →

Cloud security posture

AEGIS::GRID

Fix a fictional Microsoft 365 tenant and watch its score climb from 38 to 100. The Go engine runs as WebAssembly.

  • Go + WASM
  • CIS benchmarks
  • Entra ID
Harden the tenant →

Research · First model complete

Poisoned Context

When a stored database record contains instructions or false data, does an AI assistant trust it? I tested Claude Haiku 5.5 across 1,184 trials on a fictional directory. It never obeyed a planted command, but it often believed false data unless warned.

  • 0 of 864 planted commands were followed, including 0 of 512 attempts to misuse an email tool.
  • 17 of 20 undefended trials were misled when the false data sat on the record asked about, against 6 of 20 on an unrelated record.
  • 91% agreement between my blind coding and a blind AI second coder (kappa 0.82).

One model, one fictional directory and fixed templates, so these numbers don't generalize. All three defended conditions include the warning. Zero command success doesn't show robustness against an adaptive attacker.

  1. A field gets poisonedAn outsider writes instructions into a note through a form or import.
  2. The record reaches the modelThe assistant receives live records as trusted-looking context.
  3. Staff ask a normal questionNothing in the request suggests an attack.
  4. The reply is scoredDid the model comply, warn the user and still answer correctly?

4 defenses

  • None
  • Warning
  • Delimiters
  • Datamarking

6 payload styles

  • Naive override
  • Fake administrator
  • Spoofed system tag
  • Friendly staff tip
  • Record-style correction
  • Routine procedure

3 attack goals

  • Print a canary
  • Give a false number
  • Misuse an email tool

Also measured

  • Lookup and email tasks
  • Normal accuracy
  • False alarms
  • Payload placement
Read the method and dataExplore the exact prompts

Flagship system

County Connect

An internal platform I created and maintain, replacing a legacy CRM with one the Association owns. It's staff-only, so there's no public link.

The problem. Staff tracked relationships with county officials in a legacy CRM and their own spreadsheets, so there was no dependable source of truth.

What I built. A FastAPI and SQLite application on a single Azure VM, with Microsoft 365 sign-in, audit logs, nightly jobs and no per-seat CRM licensing. It's now the Association's system of record for 4,300+ contacts across all 100 counties.

How it's run. Daily off-site backups go to geo-redundant Azure storage and were validated with a test restore. A disaster recovery runbook, operations guide and technical reference are kept current, and features ship in phases.

  • Python
  • FastAPI
  • SQLAlchemy
  • Azure
  • Entra ID
  • Microsoft Graph
  • Anthropic API
CoatesBotAnthropic API assistant given live data on all 100 counties at request time.
Election ModeMatches about 775 State Board of Elections candidates to contacts and builds post-election update lists.
Connect ExplorerSeven-view county data platform with a legislative delegation crosswalk.
Legislative Issue TrackerBill tracker built for a Year 1 Strategic Plan task.
AutomationNightly Mailchimp sync for 800+ contacts, reminders and Teams digests.
County mapInteractive county and district map with FEMA disaster overlays.

Security tooling

Each status shows where a tool actually runs. "Production" means it's deployed in the environment I administer.

SIGNAL::WATCH

Production

Zero-dependency Sigma detection engine in Go, with its own YAML parser, recursive-descent condition parser, sliding-window correlation and Teams alerts. 19 tests pass under the race detector.

  • Go
  • Sigma
  • Detection

Source shared on request

COUNTY-GRID

Production

Daily Microsoft 365 and Entra posture scans using a managed identity and six read-only Graph permissions, so no credentials are stored on the host. AEGIS::GRID is the public version.

  • Go
  • Microsoft Graph
  • Managed identity
Live labAEGIS::GRID source

EVTXplorer

Public · CI

Windows Event Log analyzer with 21 YAML rules mapped to MITRE ATT&CK, threshold detections, and JSON, CSV and HTML reports. 27 tests.

  • Python
  • ATT&CK
Live labSource

Portcullis

Public · CI

Scans file trees and git history for secrets using regex rules, entropy checks and false-positive filters. 65 tests.

  • Python
  • Git
  • T1552
Live labSource

netrecon

Public · CI

Raw-socket port scanner, banner grabber, DNS enumerator and WHOIS client for authorized testing, with no nmap wrappers. 51 tests.

  • Python
  • Sockets
Source

NetPulse

Public

Outage monitor for Meraki and FortiGate networks, built after a recurring DHCP failure. It correlates client counts, probes and DHCP events to suggest a likely cause.

  • Python
  • FastAPI
  • Meraki API
Source

More browser tools

ToolWhat it doesData
Recon ToolkitPassive domain lookup: RDAP, DNS, certificate transparencyPublic APIs
CVE ExplorerSearch the National Vulnerability Database with CVSS filtersNVD API
IP IntelGeolocation, ASN, reverse DNS and blocklist checks for an IPPublic APIs
NetForgeDraw and export network topologies with VLANs and subnetsOffline
CloudCraftPlan Azure architectures and export TerraformOffline
RunbookBuild IT procedures and checklists, then export themOffline
FlowStateDesign automation workflows visuallyOffline
BLACKSITERed and blue team exercise with a solvable CTF arenaSimulated
PHANTOM::RESPONSEPractice incident response against a NIST SP 800-61 playbookSimulated

How I work with AI

I use AI coding tools where they help. I decide what gets built, test it against reality and own what ships. These are the kinds of problems that review catches.

A fix that would have dropped 706 members

A proposed change to a statewide program group looked right in isolation. I checked it against the real membership, saw it would silently remove people, and changed the design.

A detection rule that could never fire

A draft SIGNAL::WATCH rule required one event to be both ID 4625 and 4624. We removed it and documented the gap instead of shipping false coverage.

Testing the tools on themselves

While building the Portcullis lab, a fake KEY=AKIA… line came back clean. That exposed a real gap in the CLI's rule, now fixed with a regression test.

Experience

May 2025 – Present

Technology Services Manager

NC Association of County Commissioners, Raleigh, NC

Primary helpdesk and IT contact in a hybrid Active Directory and Entra ID environment across Microsoft 365, Azure, FortiGate, Meraki and SentinelOne, working with the Director of Technology Services. Builder of County Connect and the internal IT Hub.

Sep 2022 – Dec 2024

Customer Success Manager

WingSwept (MSP), Garner, NC

Ran quarterly reviews of infrastructure and security posture across 110+ client organizations, and managed onboarding and escalations.

Jul 2019 – Sep 2022

Shift Supervisor and Console Operator

Allied Universal, Raleigh, NC

Supported security operations for 900+ First Citizens Bank branches and supervised 6 to 8 people per shift.

2025

A.A.S., Cybersecurity, and Certificate in Penetration Testing

Wake Technical Community College

Also Pearson IT Specialist: Python (2023) and Google IT Support. CompTIA Security+ exam planned for early 2027.

Off the clock

I also build games and small tools for fun, including Drop::Zone, Loot::Roulette and Glitch::Type. At home I run a Proxmox lab on a Dell PowerEdge T430.

Let's talk

I'm looking for work in AI security, frontier red-teaming and security engineering, and I'm ready to relocate to New York City.

Email meLinkedInGitHub