01
Threat Hunting & Platform Abuse
Develop hypotheses, correlate diverse telemetry and turn ambiguous signals into high-confidence investigative findings.
Joshua Clarke / Senior Security Analyst, MicrosoftI defend systems, build tools and share what works.
Practical guides to home labs, cloud security and the tooling I build for real investigations, drawn from eight years defending large environments.
Field record
Live channel data
- Years defending systems
- 8+
- Practical tutorial views
- 208K+
- YouTube subscribers
- 4.5K+
Pick a starting point.
Whether you are building your first lab or tightening a production environment, jump directly into the material that moves you forward.
Learn by building
Build a security lab
Follow practical walkthroughs for Wazuh, vulnerability scanning, virtual machines and defensive tooling.
Start your first labThink like a defender
Strengthen cloud defence
Explore security operations, automation and the field-tested thinking behind resilient environments.
Read the field notesUse better tools
Upgrade your everyday stack
See the security software, hardware and creator tools Joshua actually uses and recommends.
Explore the kitSenior analyst by day, tool builder by habit.
I'm Joshua Clarke, a Senior Cyber Security Analyst currently focused on Azure fraud and abuse threat hunting across large-scale cloud environments.
I bring a builder mindset to investigations. Alongside hands-on analysis, I create lightweight tooling and repeatable workflows that help analysts move faster, improve consistency and turn complex findings into practical next steps.
KQLPowerShellPythonAzureMicrosoft DefenderSIEM / EDR
- Experience
- 8+ years in cyber defence
- Based in
- Cheltenham, United Kingdom
- How I work
- Evidence before assumptions
- Repeatability over heroics
- Clear outputs that drive action
What I bring
Investigation depth with delivery discipline.
Four connected capabilities shaped by hands-on security operations, engineering collaboration and practical education.
02
Incident Response & Cloud Forensics
Investigate complex security events and improve repeatable forensic workflows across distributed environments.
03
Analyst Tooling & Automation
Build practical tooling that reduces repetitive work, shortens setup time and makes investigations more consistent.
04
Knowledge Transfer
Translate technical findings into clear recommendations, training and practical education for analysts and learners.
Professional record
Work experience
From enterprise IT and managed detection to consulting, cloud forensics and Azure threat hunting at Microsoft. The through-line is evidence-led investigation, clear communication and tooling that helps analysts move faster.
Current positionSenior Cyber Security AnalystAzure Fraud and Abuse Threat Hunting
Microsoft
CurrentJun 2021 - Present · 3 roles
Senior Cyber Security AnalystAzure Fraud and Abuse Threat Hunting
Dec 2025 - PresentCheltenham, remoteInvestigating Azure fraud, abuse and adversarial platform activity across large-scale cloud environments, turning ambiguous signals into findings that support detection, enforcement and disruption.
Threat huntingPlatform abuseAzure telemetrySelected impact
- Analyse attacker behaviour, infrastructure patterns, cloud resource usage and abuse tradecraft.
- Correlate diverse telemetry to develop hypotheses and produce high-confidence investigative findings.
- Build lightweight tooling that improves investigative depth, speed and repeatability.
Senior Cyber Security AnalystSecurity Operations, Incident Response and Cloud Forensics
Dec 2023 - Dec 2025Cheltenham, remoteLed cloud forensic and incident response improvements across globally distributed investigations, combining operational delivery with training, mentorship and analyst tooling.
Cloud forensicsIncident responseMicrosoft DefenderSelected impact
- Designed a serverless forensic platform that reduced analyst setup from hours to minutes.
- Improved Windows Defender and Defender for Cloud coverage with investigative findings.
- Delivered specialised incident response, forensics and cloud security training.
Cyber Security Analyst IISecurity Operations and Incident Response
Jun 2021 - Dec 2023Cheltenham, remoteLed and supported complex investigations across Azure, Microsoft 365, Gaming and corporate environments, including incidents involving advanced threat activity.
Security operationsIncident responseAutomation
Accenture UK
May 2020 - Jun 2021
Security Delivery Consultant
May 2020 - Jun 2021United KingdomEstablished and supported a multi-cloud, threat-led security operations service for a government client, protecting critical national cloud infrastructure.
AWS and AzureProtective monitoringService development
Useful security thinking, without the noise.
Newest field noteSecurity OperationsVideo paired
Windows Memory Forensics with Volatility 3: A Practical Walkthrough
Investigate Windows memory with Volatility 3: reconstruct process trees, inspect DLLs and handles, and assess suspicious code in two TryHackMe lab cases.
8 Sept 202611 min
02 / Security Operations
I Added AI to Wazuh: YARA Alert Enrichment Explained
Build a Wazuh Active Response workflow that scans Windows files with YARA, removes positive matches, and adds an LLM explanation to the alert.
26 Aug 20269 min
03 / General
AI Usage Monitor: Codex Limits on Stream Deck Keys
AI Usage Monitor puts Codex usage limits on Stream Deck keys, showing 5-hour and weekly allowance without dashboards, tabs, or surprise throttling.
30 Apr 20269 min
From the YouTube comments
Proof from the people watching.
A few comments from viewers who found the videos useful in the real world, from lab setup walkthroughs to practical security tooling and incident response walkthroughs.
Your IP travels before you do.
This is the coarse location a website can infer from your connection, without asking for GPS permission.
Resolving approximate signal…
Observed location
Locating…
A VPN can mask your public IP and change the location websites infer. It improves privacy, but it does not make you anonymous.
Explore Proton VPNCompare privacy tools
Affiliate link · I may earn a commission at no extra cost to you
Location is approximate and may reflect your ISP or VPN exit server.
Get in touch.
Have a question, collaboration or speaking opportunity? Send the details and I'll get back to you as soon as possible.
Message composer
Tell me what you need
Routing details
