AI Security Researcher / Security Engineer
Garrett Ennis
Building AI-assisted attackers, and the defenders that stop them.
About
I am a master’s student and researcher at the SecAI Lab at Sungkyunkwan University (SKKU), and a security engineer by background. My work covers both sides of one problem: how AI assistance changes what an attacker can do at scale, and what a defender needs in order to keep pace. Before moving into research, I designed SOC architectures and SIEM ingestion pipelines for regulated environments. The limiting factor there was rarely detection logic. It was alert volume that no team could triage, which is the constraint my research starts from.
Experience
-
AI Security Researcher, SecAI Lab, SKKU
- Study how AI assistance changes adversary capability, and what detection has to do once reconnaissance and evasion are cheap to automate.
- Evaluate where AI assistance lowers analyst load in a security operations center (SOC), and where it moves the bottleneck instead of removing it.
- Research in progress, with no published results yet.
-
Lead Security Engineer, SysArc
- Led the security engineering and incident response team.
- Directed threat hunting initiatives and cloud security operations across Azure and Microsoft 365 environments.
- Delivered executive-level reporting and strategic security posture assessments.
-
Security Engineer, SysArc
- Helped enterprises and government contractors reach and maintain NIST 800-171 and CMMC compliance.
- Designed and implemented enterprise SOC architectures for commercial and government contractor clients.
- Engineered SIEM ingestion pipelines processing firewall, endpoint, and cloud telemetry; improved alert fidelity and reduced noise through structured normalization validation.
- Wrote and tuned SIEM detection rules across endpoint, firewall, and cloud telemetry to expand attack coverage.
- Managed the cybersecurity tool stack for the proactive services department.
-
Software Engineer III, Cybersecurity (Pentest), Walmart Global Tech
- Conducted enterprise application penetration testing for web and mobile platforms.
- Scoped and ran assessments as the final gate in the application development cycle.
- Developed structured threat models and collaborated with engineering teams to integrate secure SDLC controls.
- Evaluated authentication, authorization, and input sanitization implementations in high-sensitivity environments.
-
Earlier: Network Administrator, Blue Heron Systems
Education
-
M.S. Computer Science and Engineering (AI), Sungkyunkwan University (SKKU) 성균관대학교
SecAI Lab. Research on AI-assisted defense and SOC automation.
-
Microsoft Certified: Security Operations Analyst Associate (SC-200)
Earned February 2024, expired February 2026. Verification page
-
B.S. Computer Networks and Cybersecurity, University of Maryland Global Campus
Completed after transferring credits from Anne Arundel Community College. Minor in East Asian Studies.
-
Associate degrees, Cyber Security and Computer Networking, Anne Arundel Community College
Dual degrees. Concentration in computer and information systems security and information assurance.
Research
Each area links to my reading list for it: peer-reviewed papers, linked to the publisher, none of them mine.
AI-augmented adversarial attack and defense
How automated offense changes attacker cost, and what detection has to do once reconnaissance and evasion are cheap.
Reading list · 6 papersSOC optimization
Where AI assistance lowers analyst load, and where it moves the bottleneck instead of removing it.
Reading list · 4 papersThreat hunting and adversary intelligence
Hunting, OPSEC, and tracking adversary infrastructure over time, including what that tradecraft costs to sustain.
Reading list · 5 papersProjects
Multi-tenant SIEM architecture
Three SIEM platforms across more than 30 government-contractor clients, each chosen for the estate it had to monitor, all feeding one alert queue.
How I approached it Live projectAPT Explorer
A public, non-commercial explorer for the threat-actor data in a CCS 2025 paper by my labmate Shakhzod Yuldoshkhujaev. A Python pipeline rebuilds the data every week, and a static site lets you browse actors, reports and reporting trends.
Open APT Explorer (opens in a new tab)Cloud identity threat model
A threat-modeling walkthrough for Azure and Microsoft 365 identity flows. It maps privilege-escalation paths and ranks them by what an attacker gains.
The systems are covered by agreements. The reasoning is not.
Radio
Tracks play from YouTube, so nothing loads from Google until you press play. The bar fields across the site follow whatever is playing.
- WannaCry Ninajirachi & Porter Robinson
- Hard Refresh (DJ Dave Remix) DJ Dave
- The Peace (Frost Children Remix) underscores
- iPod Touch (Madeon Remix) Ninajirachi
Contact
I am looking for research collaborations and opportunities to present at conferences. If you work on AI-assisted defense, detection engineering, or SOC automation, I would like to hear from you.
Based in Suwon (수원), South Korea, with a home base in Maryland, USA. Send research and collaboration email to my SKKU address, and everything else, including recruiting, to my personal one.
- Research and collaboration (SKKU)
- redrobe9@g.skku.edu
- Everything else (personal)
- williamgarrettennis@gmail.com