01
Threat Hunting & Platform Abuse
Develop hypotheses, correlate diverse telemetry and turn ambiguous signals into high-confidence investigative findings.
Joshua Clarke / Senior Security Analyst, MicrosoftI defend systems, build tools and share what works.
Practical guides to home labs, cloud security and the tooling I build for real investigations, drawn from eight years defending large environments.
Field record
Live channel data
- Years defending systems
- 8+
- Practical tutorial views
- 231K+
- YouTube subscribers
- 4.6K+
Pick a starting point.
Whether you are building your first lab or tightening a production environment, jump directly into the material that moves you forward.
Learn by building
Build a security lab
Follow practical walkthroughs for Wazuh, vulnerability scanning, virtual machines and defensive tooling.
Start your first labThink like a defender
Strengthen cloud defence
Explore security operations, automation and the field-tested thinking behind resilient environments.
Read the field notesUse better tools
Upgrade your everyday stack
See the security software, hardware and creator tools Joshua actually uses and recommends.
Explore the kitSenior analyst by day, tool builder by habit.
I'm Joshua Clarke, a Senior Cyber Security Analyst currently focused on Azure fraud and abuse threat hunting across large-scale cloud environments.
I bring a builder mindset to investigations. Alongside hands-on analysis, I create lightweight tooling and repeatable workflows that help analysts move faster, improve consistency and turn complex findings into practical next steps.
KQLPowerShellPythonAzureMicrosoft DefenderSIEM / EDR
- Experience
- 8+ years in cyber defence
- Based in
- Cheltenham, United Kingdom
- How I work
- Evidence before assumptions
- Repeatability over heroics
- Clear outputs that drive action
What I bring
Investigation depth with delivery discipline.
Four connected capabilities shaped by hands-on security operations, engineering collaboration and practical education.
02
Incident Response & Cloud Forensics
Investigate complex security events and improve repeatable forensic workflows across distributed environments.
03
Analyst Tooling & Automation
Build practical tooling that reduces repetitive work, shortens setup time and makes investigations more consistent.
04
Knowledge Transfer
Translate technical findings into clear recommendations, training and practical education for analysts and learners.
Professional record
Work experience
From enterprise IT and managed detection to consulting, cloud forensics and Azure threat hunting at Microsoft. The through-line is evidence-led investigation, clear communication and tooling that helps analysts move faster.
Current positionSenior Cyber Security AnalystAzure Fraud and Abuse Threat Hunting
Microsoft
CurrentJun 2021 - Present · 3 roles
Senior Cyber Security AnalystAzure Fraud and Abuse Threat Hunting
Dec 2025 - PresentCheltenham, remoteInvestigating Azure fraud, abuse and adversarial platform activity across large-scale cloud environments, turning ambiguous signals into findings that support detection, enforcement and disruption.
Threat huntingPlatform abuseAzure telemetrySelected impact
- Analyse attacker behaviour, infrastructure patterns, cloud resource usage and abuse tradecraft.
- Correlate diverse telemetry to develop hypotheses and produce high-confidence investigative findings.
- Build lightweight tooling that improves investigative depth, speed and repeatability.
Senior Cyber Security AnalystSecurity Operations, Incident Response and Cloud Forensics
Dec 2023 - Dec 2025Cheltenham, remoteLed cloud forensic and incident response improvements across globally distributed investigations, combining operational delivery with training, mentorship and analyst tooling.
Cloud forensicsIncident responseMicrosoft DefenderSelected impact
- Designed a serverless forensic platform that reduced analyst setup from hours to minutes.
- Improved Windows Defender and Defender for Cloud coverage with investigative findings.
- Delivered specialised incident response, forensics and cloud security training.
Cyber Security Analyst IISecurity Operations and Incident Response
Jun 2021 - Dec 2023Cheltenham, remoteLed and supported complex investigations across Azure, Microsoft 365, Gaming and corporate environments, including incidents involving advanced threat activity.
Security operationsIncident responseAutomation
Accenture UK
May 2020 - Jun 2021
Security Delivery Consultant
May 2020 - Jun 2021United KingdomEstablished and supported a multi-cloud, threat-led security operations service for a government client, protecting critical national cloud infrastructure.
AWS and AzureProtective monitoringService development
Analyst who ships
I don't just work the case. I build the tools that close it faster.
Most analysts work with the tools they're handed. When mine slow me down, I build better ones: triage scripts, automations and platforms that make slow, manual work fast and repeatable. It's the same instinct behind the serverless forensic platform I designed in my day job, which cut analyst setup from hours to minutes.
Almost all of that code lives in private repositories, so my public GitHub looks quiet. GitHub still counts every commit without showing a line of it, so the graph below is the real picture, refreshed every few hours.
99%
of my contributions over the last 12 months went to private repos. 2,508 private, 18 public.
Contribution graph: 2,526 contributions · last 12 months
- Contributions
- 2,526
- in the last 12 months
- Active days
- 248
- with at least one commit
- Longest streak
- 57 days
- and still going
- Busiest day
- 68
- contributions on 13 Oct
Useful security thinking, without the noise.
Newest field noteGeneral
Proton Black Friday Deals 2026 - The Best Privacy & Security Discounts of the Year
Proton's Black Friday 2026 sale - the best discounts on Proton VPN, Mail, Pass, Drive and Unlimited, and why these tools belong in every cybersecurity and privacy-focused professional's stack.
26 Oct 20266 min
02 / Security Operations
Breached: My AI Spend Cap Was the First Warning
A Gemini spend cap hit early was my first sign of the October 2026 Railway security incident. Here's what rotating every production secret involved.
25 Oct 202621 min
03 / Security Operations
Windows Memory Forensics with Volatility 3: A Practical Walkthrough
Investigate Windows memory with Volatility 3: reconstruct process trees, inspect DLLs and handles, and assess suspicious code in two TryHackMe lab cases.
8 Sept 202611 min
From the YouTube comments
Proof from the people watching.
A few comments from viewers who found the videos useful in the real world, from lab setup walkthroughs to practical security tooling and incident response walkthroughs.
Your IP travels before you do.
This is the coarse location a website can infer from your connection, without asking for GPS permission.
Resolving approximate signal…
Observed location
Locating…
A VPN can mask your public IP and change the location websites infer. It improves privacy, but it does not make you anonymous.
Explore Proton VPNCompare privacy tools
Affiliate link · I may earn a commission at no extra cost to you
Exposure report
Location is only the start. See what else your browser gives away.
Runs in your browser and nothing is stored. The WebRTC check contacts Cloudflare's public STUN server, the same thing a video call does.
Location is approximate and may reflect your ISP or VPN exit server.
Get in touch.
Have a question, collaboration or speaking opportunity? Send the details and I'll get back to you as soon as possible.
Message composer
Tell me what you need
Routing details
