Paul Arriola

Paul Arriola

Security Systems Engineer

Endpoint Security · Detection Engineering · Cloud Asset Visibility

Littleton, Colorado

I work on security problems involving endpoint coverage, fragmented cloud inventory, unclear system ownership, and detection operations. My recent work has included Palo Alto Cortex XDR and XSIAM, cloud asset analysis across AWS, Azure, OCI, and GCP, and practical investigation of gaps between infrastructure records and deployed security controls.

View selected work View résumé Contact

01

Selected Work

Security engineering and software work supported by the public career record and local project repository.

Endpoint coverage

Cloud asset and endpoint coverage analysis

Environment
One Cortex XSIAM tenant; EC2 instances and EKS nodes and workloads; approximately 1,200 cloud accounts across seven business or platform estates.
Responsibility
Coordinate EDR coverage and remediation for approximately 12,000 protected compute assets.
Approach
Track owners, estimated completion dates, blockers, and risk across separate infrastructure teams and organizational boundaries.
Result / state
Coverage work was organized around accountable owners, documented blockers, and specific remediation status.
Technologies
Cortex XSIAM, Cortex XDR, AWS EC2, AWS EKS

Investigation & reporting

Cortex XDR / XSIAM asset investigation

Environment
Enterprise endpoint inventory with cloud and host records from multiple sources.
Responsibility
Identify unmanaged, stale, disconnected, and misconfigured assets and connect findings to ownership data.
Approach
Build XQL reporting, normalize host and cloud identifiers, and correlate endpoint inventory with account and owner records.
Result / state
Ambiguous inventory records were converted into identifiable coverage gaps and remediation work.
Technologies
XQL, Cortex XSIAM, Cortex XDR, cloud asset inventories

Infrastructure analysis

Endpoint-agent deployment blockers

Environment
Cloud and on-premises systems supporting endpoint-agent deployment and reporting.
Responsibility
Determine why expected security controls were not deploying or reporting correctly.
Approach
Investigate internet egress, DNS, proxy, firewall, Linux kernel, image-pipeline, and repository-access behavior.
Result / state
Blockers were isolated at the relevant system layer and documented for the teams responsible for remediation.
Technologies
Linux, DNS, proxies, firewalls, image pipelines, software repositories

Software project

Best Plays employment-discovery platform

Environment
Private, local-first Python web application with server-rendered interfaces and a versioned database schema.
Responsibility
Design and build workflows for job collection, source evidence, ranking, feedback, research, résumé preparation, privacy, and local operation.
Approach
Preserve source versions and evidence, separate private context from employer-facing claims, expose uncertainty, and require approval before consequential actions.
Result / state
Version 2.1.2 repository with implemented application modules and additional collection, learning, integration, and operational work documented for later phases.
Technologies
Python, FastAPI, Jinja, HTMX, SQLAlchemy, Alembic, PostgreSQL, pgvector, XGBoost, scikit-learn, Docker Compose

02

Best Plays

Personal software project · repository version 2.1.2

Purpose

Best Plays addresses the fragmentation of job postings, source research, decisions, and application documents. It is a local-first job-search command center, not an automatic application submission system.

Current system

The application collects and versions postings, preserves source language, records evidence, scores separate decision dimensions, supports user feedback, and prepares approved application material. The repository also includes company research, résumé tooling, privacy boundaries, backup controls, and a mobile-oriented PWA shell.

Application
Python 3.12, FastAPI, Jinja, HTMX and vanilla browser features
Data
SQLAlchemy, Alembic, PostgreSQL with pgvector; SQLite for tests and development
Analysis
XGBoost and scikit-learn candidate ranking; deterministic evidence extraction
Collection
Replaceable collectors using HTTPX and Beautiful Soup
Documents
python-docx, pypdf, ReportLab, openpyxl
Repository
56 Python test files, 27 route modules, 54 service modules, 25 migration files

Designed and built

Core application architecture, posting and evidence workflows, multi-objective scoring, feedback, research, application and résumé workflows, privacy separation, operational controls, and local deployment configuration.

Still in development

The build plan documents further collector expansion, deeper company research, mobile resilience, mature learning and model governance, controlled integrations, and additional backup and release hardening.

03

Experience

Chronological professional history.

2025–2026

EchoStar / DISH Network

Security Engineer I, InfoSec Systems Engineering (Cortex XSIAM) · Littleton, Colorado

Coordinated EDR coverage and remediation across enterprise cloud environments. Built XQL reporting, correlated asset and ownership records, and investigated infrastructure issues affecting endpoint-agent deployment and reporting.

2019–2022

Lifetouch

Lead Photographer · Beaverton, Oregon

Coordinated multi-campus mobile studio operations, trained staff in studio systems, developed troubleshooting procedures, and maintained image-processing workflow and data integrity in the field.

2015–2019

Apple

Operations Specialist · Tigard, Oregon

Planned and delegated inventory operations, product launches, overnight resets, merchandising, and customer and business solutions. Received an Exceeding Expectations rating in 2018 for maintaining Apple Brand Standards.

2010–2011

Apple

Family Room Specialist

Managed Genius Bar workflow and queue triage, provided technical support, and performed cross-trained iOS device repair.

2004–2014

Earlier technical and design work

Marquee Entertainment Casting · Elite Cake Creations · The Belton Journal · Office Depot

Maintained computers and studio equipment, handled system repair and data recovery, built an iPad-accessible order database, set up a newspaper file server and networking, and supported production and design workflows.

04

Education

2022–2025

Associate of Applied Science in Cybersecurity

Pueblo Community College · Pueblo, Colorado

4.0 GPA · Phi Theta Kappa

Coursework

Technical study

Networking Technology, Programming, Information Assurance, Network Security, IT Certification Preparation, and SQL Coding.

Computer Network Systems coursework, ITT Technical Institute, 2003–2005.

Certificates

Public record status

No completed technical certification is named in the reviewed public résumé material. The site does not claim one.

05

Technical Skills

Security platforms

Palo Alto Cortex XSIAM, Cortex XDR, enterprise EDR operations

Cloud and infrastructure

AWS EC2 and EKS, Azure, OCI, GCP, on-premises systems, image pipelines, repositories

Detection and investigation

XQL reporting, asset correlation, endpoint coverage analysis, remediation coordination, incident-oriented troubleshooting

Networking

DNS, proxies, firewalls, internet egress, network security coursework

Systems and scripting

Linux, Python, SQL, databases, workflow design, data recovery

Software and project work

FastAPI, Jinja, HTMX, SQLAlchemy, Alembic, PostgreSQL, pgvector, XGBoost, scikit-learn, Docker Compose

06

Résumé

A finished public PDF résumé has not been added to this deployment package.

Résumé section

07

Contact

A public professional email address has not been added to this local version.

Target roles: security engineering, security operations, endpoint security, IAM, and detection-focused positions in the Denver area or remote.