About
How I got from a shop floor to a security team, and what I do with a homelab at the weekend.
I came to security sideways. I spent my later university years on the shop floor at Currys, which sounds like a detour and wasn't — years of explaining technical things to people who didn't want a technical answer turns out to be most of the job in incident management. I graduated from Glasgow Caledonian in 2023 with a BSc in Cyber Security and Networks, and from there into a NOC.
Network operations taught me the shape of a problem at 3am: what's actually broken, what's noise, and who needs to know. It also taught me how much of the work was repetitive enough to hand to a script, which is where the Python habit started. Moving to the University of Glasgow as a Systems Analyst put me on the other side of that — estate-wide projects, endpoint and identity work, a Windows 11 migration across thousands of machines — and within months I moved into the threat and vulnerability side, which is where I've stayed.
Outside work I run a homelab, which is the honest answer to how I learn anything. It's a mix of Docker, Nginx, DNS, DHCP and VPN services held together with more Bash than I'd admit to in a code review, and it's where most of the things in my portfolio started life. If you want to talk about any of it, I'm at me@tommyl22.com.
Experience
Career
University of Glasgow
2025 — Present
Current role. Threat & Vulnerability Specialist Current
Identify and remediate vulnerabilities across the university's digital estate, and automate the security processes around them.
- Run vulnerability management across the estate with Rapid7, Tenable and Nmap
- Automate security workflows in Python, PowerShell and Bash to cut manual effort
- Maintain secure servers and services underpinning the team's tooling
- Promoted into the role within months of joining as a Systems Analyst
- Rapid7
- Tenable
- Nmap
- Defender
- Python
- PowerShell
- Bash
Promoted
2025
Systems Analyst
Led process improvement for the team while supporting estate-wide endpoint and identity projects.
- Became the top ticket closer within weeks of joining
- Authored the team knowledge base and led on process improvement
- Supported the university-wide migration to Windows 11
- Recognised in numerous research papers for contributions in IT
- Intune
- Active Directory
- SCCM
- JAMF
- Defender
- Windows
- Linux
- macOS
Sword Ping Network Solutions
2024 — 2025
NOC Network Analyst
First IT role. Monitored and troubleshot multi-vendor client networks, and automated the repetitive parts of the job.
- Ranked among the top three analysts in ticket closures within the first year
- Built automation tooling in Python and authored the team knowledge base
- Trusted with major incident management for a client-focused, calm approach
- SolarWinds
- Cisco
- Juniper
- Fortinet
- Meraki
- Palo Alto
- Python
Currys PC World
2021 — 2023
Sales & Team Lead
Worked through university, translating complex technical concepts into plain, customer-focused advice.
- Colleague of the Year within the first six months
- One of the top salespeople nationwide
- Trained new staff and took on team lead duties, including running the store in the absence of senior staff
Education & certifications
Education
BSc Cyber Security and Networks
Certification
ITIL 4 Foundation
Capabilities
What I work with
Threat & Vulnerability
- Tenable — daily driver
- Nmap — daily driver
- MS Defender / Sentinel — daily driver
- Kali Linux — daily driver
- Nuclei — daily driver
- ELK / Elastic Kibana — daily driver
- Shodan
- Rapid7
- Penetration testing
- Vulnerability assessment
Endpoint & Identity
- Intune
- Active Directory
- SCCM
- JAMF
- Windows 11 migration
- Azure Roles — daily driver
- Azure Groups — daily driver
- Snow
Networking
- ELK / Elastic Kibana — daily driver
- Cisco
- Cisco FTD
- Palo Alto
- SolarWinds
- Meraki
- DNS
- DHCP
- VPN
Automation & Code
- Python — daily driver
- PowerShell — daily driver
- Bash — daily driver
- JavaScript
- SQL
- PostgreSQL — daily driver
- Java
- Power Automate — daily driver
- n8n
- Cron — daily driver
- Power BI — daily driver
Platforms
- Linux (Ubuntu, RedHat, Oracle, Kali) — daily driver
- Windows Server — daily driver
- macOS
- Docker — daily driver
- Nginx
- Azure
- Microsoft 365 — daily driver
Practice
- ITIL 4 — daily driver
- Major incident management — daily driver
- Process improvement — daily driver
- Knowledge base authoring — daily driver
- Customer service
- Management
daily driver · everything else: working knowledge
Stack
Tools and platforms
-
Cisco
-
Palo Alto
-
Defender -
Tenable -
Rapid7 -
Linux
-
Docker
-
Azure
-
Microsoft 365
-
Python
-
Power Automate
-
Power BI