I build security systems that turn noisy signals into clear, inspectable decisions.
I'm a Staff Threat Hunter focused on threat intelligence, incident readiness, and detection engineering. I build tools that make security work easier to inspect, validate, and act on.
I am currently a Staff Threat Hunter at SentinelOne, working in ThreatOps on Incident Readiness and Response. My work sits at the intersection of threat hunting, detection engineering, automation, and analyst workflows. These are some of the tools and technologies I have been working with:
See Michael Rico on GitHub for public code and project evidence.
Outside of work, I am interested in geopolitics, security research, and how technical systems shape real-world decisions.
DECEMBER 2024 - PRESENT
Lead proactive threat hunting work across incident readiness and response workflows
Build tooling, detection logic, and analyst-facing systems that make threat activity easier to investigate, validate, and communicate
OCTOBER 2023 - JULY 2024
Built and refined threat detections using large-scale data and real-time streaming systems
Combined multiple detection signals into higher-fidelity alerting patterns for security operations
AUGUST 2013 - AUGUST 2023
Tracked threat actors, analyzed anomalous activity, and identified emerging attack techniques
Wrote and deployed countermeasures quickly to improve detection and response coverage
SentrySearch
SentrySearch turns scattered threat research into searchable security profiles for malware, attack tools, and targeted technologies, with persistent reports, hybrid search, and detection guidance in one workspace.
NEXT.JS, TYPESCRIPT, FASTAPI, PINECONE, SUPABASE
SentryDigest
SentryDigest turns noisy security feeds into a daily analyst-ready briefing, with source links, severity cues, and clean HTML output you can inspect before sharing.
NODE.JS, RSS, GITHUB ACTIONS
SentryInsight
SentryInsight turns security RSS feeds into exploitation-focused threat reports, with CVE correlation, affected systems, attack vectors, and executive summaries ready for review.
PYTHON, LANGGRAPH, PYDANTIC, OPENROUTER
GRCInsight
GRCInsight turns regulatory and security feeds into audit-ready GRC intelligence, with framework mapping, agency signals, industry relevance, and concise action-oriented reports.
GO, PYTHON, AWS LAMBDA, DYNAMODB, FASTAPI
How tracing an open-source agent turned a familiar cybersecurity habit into a lesson about observability.
Read the article
