Nicolas A. Welsh

Lead cyber analysts conducting threat hunting, incident response, and digital forensic operations while building Elastic-based DFIR infrastructure and automation workflows for partner-nation cyber defense missions.

• Deployed the Elastic Stack for a segmented DFIR environment ingesting host artifacts from partner-nation forensic collections.
• Automated forensic artifact processing through OpenRelik workflows feeding directly into Elastic ingest, enabling scalable analysis across host images.
• Built and documented a full-stack DFIR kit using Ubuntu Server VMs, Elastic Stack, FLARE VMs, and NAS storage; authored an SOP now used organization-wide at CNMF.
• Implemented on-prem AI agents and CUI Codex agents capable of querying Elastic directly to automate analysis, documentation, full reports, and storyboard generation — increasing analyst throughput by up to 10x in pilot workflows.
• Lead a current mission analyzing forensic host images from a foreign partner network using Linux-based DFIR infrastructure, Elastic analytics, and SIEM workflows.
• Lead and mentor 8 cyber analysts conducting threat hunting, incident response, and forensic analysis across partner-nation enterprise networks.

Managed readiness, integration, and professional development of a 32-person cyber operations platoon supporting Cyber Protection Brigade missions.

• In-processed and integrated 200+ personnel into Cyber Protection Brigade operational units.
• Migrated administrative infrastructure from legacy shared drives to Microsoft 365 cloud systems, improving operational efficiency 70%.
• Managed 2,000+ personnel and administrative records across Army systems.
• Led training and mentorship for junior cyber personnel while overseeing onboarding and professional development.

Conducted threat hunting, digital forensics, and incident response supporting national-level defensive cyber operations.

• Conducted forward cyber operations in foreign partner countries, deploying EDR solutions across 40+ systems to establish host-level visibility.
• Identified and reported web shell exploitation on a partner network by correlating network telemetry and SIEM data in Elastic, Security Onion, Wireshark, and CyberChef.
• Discovered an advanced persistent threat (APT) backdoor during large-scale forensic analysis of 51 host images in a 96-hour hunt operation using KAPE, Splunk, and custom Python scripts.
• Used Elastic and Security Onion to pivot across logs, network telemetry, and host indicators during partner-nation threat hunting operations.
• Led training for 4+ international cyber operators, improving partner capability and long-term network defense posture.
• Supported persistent hunt operations for partner-nation networks, coordinating recurring engagements and remediation efforts.

Completed the U.S. Army Cyber Operations training pipeline, including the Joint Cyber Analysis Course (JCAC) and Cyber Common Technical Core (CCTC). Graduated as an Honor Graduate from JCAC.

Student-hire engineering role completed concurrently with full-time Computer Engineering coursework at Purdue University.

• Supported software verification efforts by developing Python scripts to automate portions of the sensor testing and reporting pipeline.
• Automated detection of sensor data uploads and report generation, reducing manual processing and improving consistency.
• Wrote and ran unit tests to validate automation workflows.
• Assisted in the design and implementation of a SQL-based solution for storing and querying sensor data.
• Built database schemas and CRUD utilities using Python and SQLAlchemy.
• Used Docker to configure and manage MySQL instances for development and testing environments.