Marcus Coleman
MarcusTheDataNerd
Security engineering, with a data habit.
Security engineer, 14+ years — vulnerability management and application security, plus the Python and ML work that turns findings into a ranked plan. M.S. Data Analytics. Active Public Trust.
Open to remote roles internationally and anywhere in the US.
- 14+ yrs security
- 8+ yrs appsec
- M.S. Data Analytics
- CPTE
- Public Trust — active
- Remote — worldwide & US
Practice
What I do
Nine areas on the About page; these five are where most of the
work sits.
- 01
Vulnerability Management
Run the program end to end: risk-based SLAs, triage, remediation tracking, MTTR reduction.
- 02
Application Security
SAST and DAST triage with source-code comprehension, false-positive analysis, retest and fix verification, secure SDLC, developer remediation guidance.
- 03
Security Automation & Engineering
Python pipelines that ingest scanner and ticket data, produce KPI dashboards, and shift scanning left into CI/CD.
- 04
Offensive Security
Web-app and network penetration testing, scope and methodology definition, exploitation validation, custom Python tooling.
- 05
Data Analytics & Machine Learning
Supervised and unsupervised learning, time series, NLP, hypothesis testing, and predictive modeling applied to risk scoring and remediation forecasting.
Track record
Selected work
By sector and outcome.
Federal biomedical & health research
- Direct an enterprise vulnerability-management program spanning 350+ web applications and services and tens of thousands of findings across AWS and on-prem.
- Built a Python pipeline that ingests scanner output and ticket data into executive KPI dashboards, cutting manual assessment time ~40%.
- Integrated code scanning, secret detection, and dependency review into CI/CD; triage SAST and DAST findings with the engineering teams that own the code.
- 90% remediation success rate; 30 / 15-day critical MTTR (internal / public-facing).
Federal research operations
- Led the first enterprise-wide DAST rollout in the environment.
- Triaged 300+ application and infrastructure findings monthly with risk-based scoring.
- Built the validate / retest / sign-off workflow with system owners.
- Supported ATO packages and continuous monitoring against NIST SP 800-53.
Payment processing / PCI-DSS
- Manual web-application and network penetration testing across PCI-scoped infrastructure, following the OWASP Testing Guide and NIST SP 800-115.
- Malware incident investigation and EDR alert triage on an on-call rotation.
- Risk-quantified reports with prioritized remediation roadmaps.
- Built a Splunk SIEM from the ground up: log onboarding, correlation, alerting.
- Managed Cisco ASA firewall infrastructure and recurring Tenable assessment cycles.
- Drove a PCI-DSS initiative from gap analysis to audit certification; hardened systems to CIS Benchmarks.
See the full work history on
LinkedIn.
- ~40% less manual assessment processing time, via a Python automation pipeline
- 90% remediation success rate across all severity levels
- 30 / 15 day critical-finding MTTR — internal / public-facing
- 350+ web applications and services under enterprise vulnerability management
- 10,000s of vulnerabilities managed enterprise-wide
- 300+ application / infrastructure findings triaged monthly in an earlier federal role
- 15,000+ user environment secured and trained
- 14+ years in cybersecurity; 8+ in application security
Building
Projects
Security tooling built in the open on public and synthetic data. Full set on the
Work page.
Turn a list of CVEs into a single ranked queue that reflects exploitability, not just severity.
- Problem
- CVSS base score alone over-flags. A queue sorted by it buries the few findings that are actually being exploited under thousands of high-but-quiet ones.
- Approach
- A small Python library that pulls CVSS from the NVD feed, exploit-prediction scores from the FIRST EPSS API, and known-exploited status from the CISA KEV catalog, then blends them into one transparent priority score with tunable weights.
- Result
- A CSV or notebook in, a ranked action list out — with the reasoning for each rank shown, so a remediation team can defend the order to system owners.
Stack: Python · pandas · requests · NVD API · FIRST EPSS · CISA KEV · Jupyter
Raw scanner exports in; MTTR, aging, and SLA-breach dashboards out.
- Problem
- Scanner consoles answer 'what is vulnerable' but not 'are we keeping up'. Leadership needs trend lines — mean time to remediate, backlog age, SLA breaches — and those live across exports nobody has time to reconcile by hand.
- Approach
- A reproducible pipeline: generate synthetic Nessus- and Invicti-style exports, normalize them into a single findings table, compute program metrics, and render a Streamlit dashboard with drill-down by severity, asset class, and age bucket.
- Result
- One command refreshes the whole view. The synthetic generator doubles as a portable test fixture for anyone building similar reporting.
Stack: Python · pandas · Streamlit · Plotly · synthetic data generator
A calibrated estimate of how long a finding will take to close — and an honest account of where the model breaks.
- Problem
- Planning remediation capacity means guessing which findings will drag. Severity is a weak proxy: some criticals are a one-line patch, some mediums need a vendor and a change window.
- Approach
- Supervised learning on a synthetic findings dataset — gradient-boosted trees and logistic regression — predicting whether a finding closes within its SLA. Full treatment of class imbalance, probability calibration, and feature leakage.
- Result
- A model card that states accuracy, calibration, and the conditions under which the estimate should not be trusted — the part most write-ups skip.
Stack: Python · scikit-learn · pandas · matplotlib · model card
Open to remote roles
Application security, vulnerability management, or security automation.
Open to remote roles internationally and anywhere in the US. Active Public Trust. The best way to reach me is LinkedIn —
a message or a connection request both work.