Shaun Halverson

A multi-agent threat hunting system I designed and built — seven specialized agents coordinated by an orchestrator to triage, enrich, and verify security events end-to-end.

• Normalization — Intakes new events, normalizes and extracts artifacts.
• EDR — EDR enrichment & telemetry context.
• HostFinder — Finds all information possible about a given host.
• UserFinder — Finds all available information about a user.
• OrgKnowledge — Enriches events with context from internal SOPs / documents.
• HistoricalKnowledge — Enriches events with context from past closed cases.
• Verifier — Combines everything, summarizes, builds a timeline, and points out gaps.

An internal web platform I build and maintain that hosts 75+ small apps used across IT — from automation utilities to tracking dashboards. Below is the Website Security Scanner module, which scans internal servers for HTTP security headers and assigns each a score.

• 400+ — unique users across IT.
• Millions — of page visits per year.
• 75 — individual apps hosted under one platform.
• Website Security Scanner — example app — scans internal servers for HTTP security headers and assigns a score.

An internal hot-desking platform used across IT and other departments to reserve shared workspaces. Users manage reservations across multiple days and see exactly where teammates are sitting — including title and department — on an interactive floor map.

• 700+ — users across IT and other departments.
• Multi-day — reservations — book and manage future days at a glance.
• Live floor map — see who's sitting where, with title and department.
• Multi-site — switch between offices and floors from one view.

An AI threat evaluator built directly into our SOAR platform. NATE fuses OpenAI with historical case data and live EDR telemetry from the endpoint to produce high-fidelity event summaries — full timeline, historical context, verdict, and analyst-ready notes. It's measurably cut threat hunting time and runs with strong accuracy at scale.

• 5,000+ — events evaluated per month, end-to-end.
• SOAR-native — embedded directly into the Splunk SOAR workflow.
• EDR + History — fuses S1 endpoint telemetry with vectorized past cases.
• Verdict + Timeline — produces summary, timeline, historical context, and gaps.

Led the company-wide rollout of SentinelOne EDR to over 10,000 endpoints and now serve as the organization's SME for the platform. Day-to-day I own forensic investigations, EDR rule design and tuning, EDR-driven threat investigations, blocklist management, exclusion management, and every other lever the platform exposes — essentially all things EDR at Quad.

• 10,000+ endpoints — Led the org-wide SentinelOne deployment across the full endpoint fleet.
• Org-wide SME — Primary point of contact for EDR strategy, escalations, and tuning.
• Rules & investigations — Author detection rules and drive forensic + EDR investigations end-to-end.
• Blocklists & exclusions — Own day-to-day blocklist and exclusion management across the platform.

Vulns is the complete in-house Vulnerability Management platform I built — webapp plus backend API — that automates everything vulnerability-related at Quad. Tickets are issued through it every week and hundreds of users interact with it weekly across many built-in apps and features that make management simpler for everyone involved. Vulny is the AI assistant layered on top: a chat-first interface that calls Vulns' own API routes to kick off ad-hoc scans, look up tickets, check CVE hits, inspect ticketing exclusions, and more.

• Full platform — webapp + backend API that automates all things vulnerability.
• Hundreds/week — hundreds of users interact with Vulns every single week.
• Weekly tickets — issues vulnerability tickets on a weekly cadence.
• Vulny AI — chat assistant that drives the platform's own API to take action.

A custom web-based arcade game I built — Donkey Kong-style platformer reskinned and themed to Quad. It started as my hands-on learning project for Kubernetes: containerizing the app, managing image rollouts, and wiring up CI/CD pipelines that ship across dev, beta, and prod.

• Donkey Kong–style — arcade platformer, fully reskinned and themed to Quad.
• Custom web app — built from scratch — gameplay, sprites, levels, scoring.
• Kubernetes — containerized and deployed on K8s as my learning project.
• CI/CD pipelines — automated dev → beta → prod rollouts with image management.