I'm Michelle Duell, transitioning from military intelligence to cybersecurity with a focus on defensive security and threat intelligence.

I work as an intelligence analyst, where I've spent years analyzing patterns, tracking adversaries, and turning complex data into actionable insights. Those same skills translate directly to what I'm passionate about now: blue team operations, incident response, and threat hunting. I also co-presented at the WiCyS 2026 Conference in Washington, DC on reverse engineering with Ghidra for DNS exfiltration detection, covering static binary analysis from novice to professional level. More recently, I've been volunteering with the KC7 Foundation as an AI Workflow Engineer and Threat Content Analyst, where I contributed to a published threat scenario and built a content pipeline that cuts scenario production time from 2-3 months down to about 2 weeks.

As a SANS Cyber Academy Scholar and GIAC Advisory Board member, I've earned GCIH (98%), GSEC (95%), and GFACT (100%) certifications, along with a Trusted AI Safety Expert (TAISE) certification from the Cloud Security Alliance. I've put those skills to the test in competition, placing 1st in the Tenable x WiCyS CTF, 1st Overall and 1st Industry Professional at the WiCyS 2026 Conference CTF, 1st in the WiCyS Cyber Quest Tournament, 2nd in the SANS Women's History Month BootUp CTF, 2nd in the WiCyS x Target Cyber Defense Challenge, and earning Runner-Up Most Creative Report and 5th place in the SANS Holiday Hack Challenge.

Outside of competitions, I'm building practical experience through my homelab and independent research. The GCP honeypot is complete, 96 million events across 28 days documented in a 14-report research series. AeroLab v2 is the current focus: a full rebuild across two physical Proxmox nodes with five segmented networks and a detection stack built around Elastic SIEM 9.x, Velociraptor for endpoint forensics, and MITRE Caldera for ATT&CK-mapped adversary emulation against a Windows Server 2022 domain controller. The goal is simple: run an attack, see what the SIEM catches, write a Sigma rule, repeat. I'm also working through the Cisco CCNA 200-301 curriculum via the NetworkChuck Summer of CCNA to sharpen the networking fundamentals that sit underneath all of it.