OT / ICS Security

Jason Callahan

Navy veteran · OT/ICS security analyst · homelab builder

CySA+ · Security+ · Network+ · ISC2 CC · B.A.A.S. Cybersecurity, EIU, 2027

I've supported the systems that keep a 24/7 automotive plant moving: Rockwell MES, Ignition SCADA, PLC data tags, HMIs and the industrial network underneath them. Now I'm focused on securing that IT/OT boundary. At home I run a segmented lab that I build, break and fix on purpose.

Open to remote OT/ICS security and SOC roles

Selected work

MES tier 1 diagnostics script

A script that automates the first round of troubleshooting on the Ubuntu HMIs that run Rockwell MES on an automotive production floor. Every tech runs the same checks in the same order, every time.

Why it matters: on a live production line, every minute an HMI is down is lost output.

  • Bash
  • Ubuntu
  • Rockwell MES
  • OT support

View the repo →

Segmented home lab, run like production

A pfSense firewall with six VLANs and an Omada SDN controller, Proxmox containers, a TrueNAS ZFS pool, and a GPU server running local LLMs. Every machine's scheduled jobs live in one inventory, and nothing gets added without a line in it.

Backups: weekly container snapshots to the NAS, plus an encrypted cold archive in S3 Glacier Deep Archive. The upload credential can write but can't delete.

  • pfSense
  • VLANs
  • Proxmox
  • TrueNAS
  • AWS IAM
  • llama.cpp

ESP32-S3 DNS sinkhole

I replaced a Raspberry Pi running Pi-hole with a thumb-sized ESP32-S3 and a wired W5500 Ethernet module. It runs off another host's USB port and blocks ad and malware domains on wired Ethernet, without depending on Wi-Fi.

  • ESP32-S3
  • C++
  • W5500 / SPI
  • DNS

View the repo →

Testing a trading strategy until it broke

I backtested a gap-and-go day-trading rule on every US stock over five years: 13,327 trades and 10,080 parameter combinations, split into separate train and test periods.

Result: before costs there was a real but tiny edge (+$3.04 per trade, t = 4.6). Spreads wiped it out. I killed the strategy instead of fooling myself, and that's the same discipline good detection engineering needs.

  • Python
  • pandas
  • Polygon data
  • Statistics

Toolbox

OT / ICS
Ignition SCADA, Rockwell MES, PLC/HMI, EtherNet/IP, CIP, Modbus, Purdue Model, ISA/IEC 62443, NIST SP 800-82
Security ops
Elastic SIEM, Suricata, Wireshark, Nmap, incident response (NIST SP 800-61), vulnerability management
Infrastructure
Linux, Windows and Active Directory, pfSense, Proxmox, Docker, AWS, Terraform
Code
Python, Bash, PowerShell, ESP32 firmware, Git and GitHub Actions

Verification

Anthropic Cyber Verification Program

DEFENSE ACCESS · APPROVED

Approved for Defense Access: dual-use security work (pentesting, red teaming, bug bounty) is allowed on my account. Confirmed by Anthropic's Safeguards Team, July 24, 2026.

Read the email excerpt

Thank you for submitting your application for the Cyber Verification Program. Upon reviewing the details of your submission, we have adjusted the safeguards applied to your account to allow for the cyber use cases you described.

Dual-use cybersecurity activities (e.g. basic pentesting, red teaming, and bug bounty use cases) will no longer be blocked by default for the account(s) associated with this approval: Anthropic Organization ID: xxxxxxxx-xxxx

This adjustment is limited to the use case you described in your submission and is subject to Anthropic's Usage Policy.

Organization ID and reference number redacted. The original email is available on request for verification.