Hi, I'm Matt.
Cybersecurity analyst in New York. Public-sector security testing by day, and a personal homelab that has long outgrown the word "homelab" in every hour after.
About
I came into security the long way. It started as an intern at Oak Ridge National Laboratory in Tennessee, where I was meant to help with network security on what was, at the time, the fastest academic supercomputer in the world. In practice that mostly meant running a lot of Splunk queries and trying not to break it.
Then eight years at SAIC — a Fortune 500 federal IT contractor whose work runs through DoD. I was on the IT side of the house for every day of it, building my way around operating systems with hands on the keyboard. It turned out to be a pretty good on-ramp into security testing later on.
Between jobs and around them, I picked up a bachelor's in cybersecurity and a small pile of industry certifications — most of which happened because my wife kept us upright through every round of night-and-weekend schooling.
These days I lead cyber testing work for New York City's public sector. The day-to-day is mostly pentesting systems I can't name here, writing reports I hope get read, and occasionally finding something that makes everyone regret reading them.
In my younger days I also chased down a top-500 global rank on Hack The Box, back when evenings were a more renewable resource.
Off the clock, I build and run things. A few are below.
Dogs
Projects
- predsfan.com — an ongoing fan site for the Nashville Predators, with AI-generated game previews and recaps on a schedule. More backend plumbing than a hockey blog has any business having.
- xdf.nyc — a long-running personal domain I use for C2 infrastructure and domain-trust research. The kind of red-team project that gets more useful the longer you've had it.
- ilovemandi.com — exactly what it says on the tin. I love my wife very much, so at some point I bought a domain and made her a website about it. Also plays quiet secondary to xdf.nyc on the research stack — Mandi does not need to be briefed on that part.
- More in flight — I keep using AI to make things that end up extraordinarily complicated and entirely useless. One of them will stick eventually!
Contact
The short list. Email works best; LinkedIn works second-best.
- Email me@mattosterman.nyc
- LinkedIn /in/matthewostermannyc