Securing enterprises by day.
Running packets, projects & RF by night.

Security leadership & GRC

Security programs, risk management, and compliance in regulated environments — frameworks like NIST CSF and ISO 27001, audits, and board-level reporting. Building the policy set, the control framework, and the evidence trail that holds up in front of an auditor, a customer questionnaire, or a regulator.

A good part of the job is translation: turning technical risk into something a business leader can act on, and turning a board mandate into work a team can actually execute.

Enterprise infrastructure

Networks, datacenters, cloud, and endpoint fleets — designed, modernized, and operated at scale for organizations that can't afford downtime. Routing and switching, virtualization, storage, identity, and the operational discipline that keeps all of it boring.

Modernization usually means replacing something old and load-bearing without an outage anyone notices, so the sequencing and the rollback plan matter more than the technology on the invoice.

Manufacturing & OT security

Securing the plant floor: industrial control systems, engineering workstations, and the equipment that stops making product when you get it wrong. Purdue Model zoning, IEC 62443 and CISA/NSA guidance, IT/OT segmentation and DMZ design, brokered remote access, and asset visibility across a global manufacturing footprint.

Built as a program rather than a project: policy and architecture standards, deployment playbooks, site assessment and maturity scoring, and a funding model that survives contact with a board.

Incident response

Building and running detection and response capabilities, from security operations centers to tabletop exercises to the real thing at 2 a.m. Detection engineering, escalation paths, forensics-ready logging, and playbooks written before anyone needs them.

The measure of a response program is not the tooling. It is how quickly the right people reach the right decision while the situation is still moving.

Independent consulting

Practical security and infrastructure guidance for small and mid-sized businesses: assessments, hardening, incident recovery, and roadmaps that fit real budgets. Engagements run from a single day on site to full network redesigns, firewall and segmentation work, and rebuilding after something goes wrong.

Smaller organizations rarely need enterprise tooling. They need the handful of controls that genuinely reduce their risk, documented well enough that whoever comes next can keep them running.

HF station

Primary rig is a Yaesu FT-710 AESS covering 80m through 6m from home, feeding a Gap Challenger vertical and a G5RV. Lately most active on digital modes — primarily FT8 and JS8Call.

All HF contacts logged with N3FJP's Amateur Contact Log and uploaded to LoTW (my preferred QSL route), eQSL, and Clublog.

Local & mobile

I am most active locally on VHF/UHF voice — usually monitoring the Fox River Radio League repeaters (W9CEQ) and other popular local machines. Base station is a Yaesu FTM-400 on a well-elevated Comet GP6, with a TYT TH-9000D covering 1.25m and a Yaesu FT5D as the go-to handheld. DMR-capable too, via an Anytone AT-D878UVII Plus.

Mobile: a Yaesu FTM-200 in the truck, second band parked on APRS for road-trip tracking.

APRS infrastructure

I run a local-coverage APRS digipeater [K9MEV-1] and igate [K9MEV-10] serving the general Batavia area — a Yaesu FT-2900 with an Argent Data OT2m tracker and a Raspberry Pi running Xastir, with home-built relay automation for remote management. Fairly active on APRS with several trackers in rotation.

Portable & homebrew

Portable HF runs on a Yaesu FT-710 in a custom go-kit, Buddipole antenna, and a custom battery pack in an ammo-can case. A home-built uBITX transceiver occasionally makes it on the air as well.

On the receive side: a Diamond D3000N discone on a multicoupler feeding various scanners and receivers, plus a dedicated ADS-B receiver reporting to FlightAware.

Self-hosting

Web, DNS, mail, and services for this domain and friends' projects — because the best way to stay sharp is to run it yourself. A redundant authoritative BIND pair, a hardened Postfix and Dovecot mail server, web, monitoring, and a public status page.

All of it is documented as though someone else might have to take it over, which is the only thing keeping a hobby platform from quietly becoming a liability. Dual-stack throughout, since IPv6 stops being intimidating once you are forced to live on it.

Electronics & making

Discrete electronics, restoring legacy compute, bench projects, microcontrollers, sensors, and the occasional repair that turns into a rebuild. Homebrew radio kits, battery packs and go-kits, antenna work, and whatever the current pile on the bench happens to be.

Half the appeal is the diagnosis: reading a schematic, chasing a fault down to a single component, and then deciding whether to fix the thing or build a better one.

Weather monitoring

An Ambient Weather WS-2000 station watches the local sky from Batavia — a full outdoor sensor array plus dedicated lightning, soil, and air-quality sensors reporting to a live console indoors.

That feeds a weather page I built for this site: current conditions, forecasts, radar and satellite, river gauges, air quality, space weather, climate normals, and a computed sky chart, with no JavaScript and no third-party requests. markvd.net/weather →

Raw station data also streams to a public console: live station dashboard →

Security tinkering

Lab environments for testing hardware, software, tools, techniques, hardening, and defenses before they ever touch production anywhere. Isolated segments, deliberately weak targets, and packet capture to see what a control actually does rather than what the datasheet claims.

It is also where the bad ideas go first. Anything I would rather not discover live gets discovered here instead, on equipment nobody is depending on and at an hour of my own choosing.