I'm Michelle Duell, a security researcher and intelligence professional with an active [REDACTED] clearance. Right now I'm an AI safety red team fellow, running adversarial testing against frontier AI systems. Behind that is eight years of operational targeting and multi-source intelligence work, a 16-report threat intelligence series, and podium finishes in national cybersecurity competitions. I'm looking for roles in threat hunting, threat intelligence, incident response, SOC, detection engineering, and AI red teaming.

Reverse engineering is where I do my deepest work. I trace suspicious samples through a decompiler to understand what they do and why, working static binary analysis in Ghidra and taking mobile apps apart with adb, apktool, and smali. I turned that methodology into a conference talk accepted from more than 1,500 proposals for the WiCyS 2026 National Conference, where I co-presented static binary analysis from novice to professional level.

I build AI tooling as much as I use it. At the KC7 Foundation I volunteer as an AI Workflow Engineer and Threat Content Analyst, where I contributed to published threat scenarios and built a pipeline of more than 40 coordinated LLM agents that cut scenario production from roughly 21 days to about 3 hours. In my own lab I wired Ghidra, radare2, jadx, dnspy, and x64dbg into LLM-assisted reverse engineering workflows through MCP.

As a SANS Cyber Academy Scholar and GIAC Advisory Board member, I've earned GCIH (98%), GSEC (95%), and GFACT (100%) certifications, along with a Trusted AI Safety Expert (TAISE) certification from the Cloud Security Alliance, and I'm currently working toward the HTB Certified Penetration Testing Specialist (CPTS). I've put those skills to the test in competition, placing 1st in the Tenable x WiCyS CTF, 1st Overall and 1st Industry Professional at the WiCyS 2026 Conference CTF, 1st in the WiCyS Cyber Quest Tournament, 2nd in the SANS Women's History Month BootUp CTF, 2nd in the WiCyS x Target Cyber Defense Challenge, and earning Runner-Up Most Creative Report and 5th place in the SANS Holiday Hack Challenge.

Outside of competitions, my homelab and independent research keep the work hands-on. The GCP honeypot is complete, 96 million events across 28 days documented in a 16-report research series. AeroLab v2 is the current focus: a full rebuild across two physical Proxmox nodes with five segmented networks and a detection stack built around Elastic SIEM 9.x, Velociraptor for endpoint forensics, and MITRE Caldera for ATT&CK-mapped adversary emulation against a Windows Server 2022 domain controller, running identity-based attacks including Kerberoasting, AS-REP roasting, Pass-the-Hash, and DCSync, then capturing and analyzing the resulting attack telemetry in Elastic SIEM. The lab also has an AI security side: a local LLM stack running open-weight Mistral models on Ollama, with tool use enabled, a retrieval pipeline built on local embeddings, and a QLoRA voice fine-tune trained in Unsloth on my own writeups. I wrote llm-redteam-mcp, an MCP tool that runs offensive tests against those models, probing prompt handling, tool use, and retrieval behavior in a fully controlled environment. I'm also working through the Cisco CCNA 200-301 curriculum via the NetworkChuck Summer of CCNA to sharpen the networking fundamentals that sit underneath all of it.