Payton Brenner
Open to cybersecurity internships & entry-level roles

Payton Brenner
Security & Risk Analysis

Information & Cybersecurity-focused student at Penn State, working across security operations, threat modeling, and AI governance.

Hands-on with intrusion detection, incident response, and network defense in the lab, plus real deliverables from a security & AI-governance internship at hello EIKO.

View projects Resume Get in touch
Program
B.S. Security & Risk Analysis
University
Penn State, University Park
Graduation
May 2027
Location
Northeast U.S. · open to relocation
0Projects & labs built
0Tools & technologies
0Honors & involvement

About

Building a foundation in defensive security and risk analysis

I'm a third-year Security and Risk Analysis major at Penn State with an Information & Cybersecurity focus. My coursework and labs center on the practical side of defense: detecting intrusions, analyzing network traffic, writing detection rules, and running incident response across both IT and operational-technology environments.

This fall (2026) I'm building on that foundation across four courses: computer and cyber forensics (CYBER 454), where I'm learning to uncover and document digital evidence; risk analysis in a security context (SRA 311), on assessing threats from intelligent adversaries; spatial analysis of risk (SRA 468), mapping hazards and vulnerabilities with GIS; and the legal and regulatory environment of technology (IST 432), covering privacy, intellectual property, and cyberspace regulation. Together they're broadening how I approach security beyond the technical exploit, to the risk, the evidence, and the law around it, and how AI is reshaping each of them.

I'm drawn to the human side of security, too. A lot of risk comes down to how people behave under uncertainty, from social engineering to how analysts fight their own confirmation bias.

Portrait of Payton Brenner, wearing a black blazer and glasses

Professional Experience

Internship at hello EIKO

Consulting, governance, and security work delivered for a real firm and its clients, presented to leadership.

Internshiphello EIKO

AI Consulting Intern: AI governance strategy, security threat modeling, and web delivery.

AI Governance System Redesign

firm-wide risk standard

Reviewed and redesigned the firm's internal AI governance framework, the system EIKO deploys to help clients govern AI use.

Benchmarked it against NIST AI RMF, ISO/IEC 42001, and competitor offerings, then audited EIKO's own methodology to surface three gaps: inconsistent risk-tier models, no quality gate on delivered plans, and no coverage of AI agents.

Authored the resulting 4-Tier Governance Model as a firm-wide risk standard, consolidated the template pack, and designed an automation layer: a 12-check quality scorecard plus a tool that turns client calls into tracked template edits. Presented findings and recommendations to firm leadership.

NIST AI RMFISO/IEC 42001risk-tier modelingpolicy designcompetitive analysisexec communication

Internal Threat Model

whole-company risk assessment

Designed and authored a whole-company threat model for hello EIKO: a decision tool for the two principals, not a technical report.

Because named frameworks target either one system or a whole org, I used a hybrid: a trimmed OCTAVE Allegro asset-based assessment as the backbone, with STRIDE applied as a checklist against technical assets, and documented why heavier frameworks like PASTA didn't fit a firm this size.

Built a risk register scoring each threat by likelihood and impact, assigned mitigations, and ordered priority actions by leverage, each tied to the risks it closes and backed by CISA, NIST, FBI, and IC3 guidance. Also wrote an NIST-aligned incident response plan, delivered in full and condensed versions.

threat modelingOCTAVE AllegroSTRIDErisk registerincident responseCISA / NIST

AI Training Event & Registration Platform

client delivery · pharma advocacy network

Worked with a small intern team to design and build a custom event platform for a large AI-training program delivered to a major pharmaceutical client's advocacy network, a series of one-hour virtual workshops.

We mapped the participant journey from invitation through registration, confirmation, and retention, then built it as a responsive, mobile-first multipage web app on EIKO's brand system.

I contributed the registration flow (sign-up forms that collect and store attendee details and cap per-session participants), automated email reminders, participation tracking, and cross-platform QA of the site and emails before launch.

View the live site
front-end devresponsive designUX / journey mappingregistration handlingemail automationQA testing

Game Recreations with AI

Personal

A self-directed project using Claude Fable as a build partner to recreate the mechanics of casual games from scratch: a Boggle-style word search (letter grid, path-based selection, dictionary validation, timed scoring) and a two-character cooperative puzzle-platformer with element-based hazards.

Rather than hand-coding each, I wrote detailed prompts specifying game logic, physics, and interface, then iterated the model's output into working web builds, solving the harder parts like word validation and platformer collision.

Recreated generic mechanics only, no branded characters or art.

prompt engineeringAI-assisted devgame logicfront-enditerative debugging

Academic Projects & Labs

Hands-on security, networking, and analysis work

Coursework and lab projects at Penn State, grouped by domain.

Filter

Security3 labs

CTF Web Exploitation

full attack chain · Kali Linux
Lab
  • Compromised a target WordPress server from a Kali workstation across the full attack chain.
  • Ran an Nmap scan to map services (HTTP/HTTPS open, SSH closed) and enumerated the web app for hidden files.
  • Cleaned a large wordlist with sort/wc into an efficient dictionary, then used wfuzz to brute-force login and enumerate a valid username.
  • Recovered the password by filtering on the server's 302 redirect.
  • Planted a PHP reverse shell via a modified 404.php page and caught the connection with a Netcat listener for command-line access.
NmapwfuzzNetcatKali LinuxWordPressLinux CLI

OT/ICS Intrusion Investigation & Response

SCADA · IT/OT boundary
Lab
  • Spotted an anomaly on the RapidSCADA HMI (values spiking into alarm) in a simulated ICS environment.
  • Captured PLC-network traffic in Wireshark and traced a source IP outside the legitimate PLC range to an IT workstation pivoting into the OT network over a VPN tunnel.
  • Isolated the malicious process with pstree and terminated it with pkill, confirming on the HMI that readings normalized.
  • Ran a full detect / investigate / contain / verify cycle across the IT/OT boundary.
WiresharkRapidSCADA / HMIPLCspstree / pkillIT-OT segmentationincident response

Network Intrusion Detection with Snort

IDS deployment & rule writing
Lab
  • Identified the sensor's active interface with ip addr show and ran Snort in sniffer mode (-v -d -e) to inspect packet headers and payloads.
  • Authored TCP, UDP, and ICMP alert rules, each with message, SID, and revision fields, to flag traffic to a target host.
  • Reconstructed an attacker-supplied keyword and its source and destination ports from the captured traffic.
  • Covered both sides of IDS work: reading raw traffic and writing the rules that generate alerts.
SnortLinuxpacket analysisdetection rules

Networking3 labs

Home & Wireless Network Configuration

Cisco Packet Tracer
Lab
  • Configured secure wireless networks across multiple residential scenarios: SSIDs, credentials, device connections, wireless NICs, and DHCP/DNS.
  • Built one network of 12 mixed devices (PCs, phones, IoT) off a cable modem.
  • Chose WPA2 over WEP/WPA to harden each network, locking down a previously exposed camera.
  • Verified every connection by browsing live sites.
Packet Tracerwireless routingWPA2DHCP / DNSSSID config

Enterprise Wired Network Design

ABC Corp · four-floor build
Lab
  • Designed a four-floor corporate wired network from scratch with a structured IP scheme segmented by floor and department (admin, finance, R&D, IT).
  • Configured switches and end devices, daisy-chaining switches where port capacity ran short.
  • Validated with router CLI (show run), per-floor IP checks, and ping tests, and confirmed intranet access.
  • Documented port usage per switch.
Packet TracerIOS CLIIP addressing / subnettingswitchingdocumentation

Multi-Campus Routing with RIP

Cisco Packet Tracer
Lab
  • Built a multi-campus network of four regional routers linked through a core backbone switch, serving dozens of building subnets.
  • Assigned inter-router and building-facing interfaces across the topology.
  • Enabled RIP for dynamic route exchange and verified end-to-end reachability with show ip route and traceroute.
  • Planned and documented the full interface addressing scheme in advance.
Packet TracerRIP routingIOS CLImulti-site topologyroute verification

Analysis & Programming3 labs

Quantitative Risk Analysis in R

SRA 365
Lab
  • Applied statistical modeling in R to cyber-incident datasets to quantify risk.
  • Built a logistic regression predicting whether an attack caused financial loss from incident response time, interpreting odds ratios.
  • Built a linear regression modeling attack frequency against response-time categories using contrast/dummy coding.
Rlogistic regressionlinear regressionodds ratioscategorical contrasts

Analysis of Competing Hypotheses

structured analytic technique
Lab
  • Used the PARC ACH tool on a witness-identification scenario to determine which of three candidates matched an eyewitness account.
  • Broke the description into discrete evidence items (age, height, hair, glasses, footwear) and scored each hypothesis for consistency against every item.
  • Reached a conclusion by ruling out alternatives rather than confirming a favored guess.
  • Applied the structured tradecraft used to counter confirmation bias in intelligence and risk analysis.
PARC ACHstructured analytic techniquesevidence weighting

"Palindrome Panic": Recursive Word Game

Python
Lab
  • A command-line word game built around a recursive palindrome-checking algorithm.
  • Loads and validates candidate words from a file and generates positional hints each turn (revealing correct placements, flagging wrong or missing letters).
  • Enforces a four-guess limit and loops for replay.
  • Written with clean function scoping, no global state, docstrings, and input validation.
Pythonrecursionfile I/Oinput validationprogram structure

Team & Communication1 project

Mobile Device Security Threat Briefing

four-person team project
Lab
  • Built a briefing on threats to modern mobile devices (smartphones, tablets, wearables) with a four-person team.
  • Covered malware, ransomware, phishing, and unsecured-network / man-in-the-middle attacks, and why mobile devices are high-value targets.
  • Recommended mitigations like MFA, patching, and BYOD controls.
  • Practiced surveying a threat landscape and communicating risk to a non-specialist audience.
mobile threat landscapesocial engineeringMFA / BYODrisk communication

Skills

Technical toolkit

Tools and concepts I've worked with directly in labs, coursework, and internship projects.

AI & LLM Tools5
ClaudeChatGPTGeminiPrompt engineeringAI-assisted development
Security Monitoring & Analysis5
ZeekpfSenseWiresharkLog analysisTraffic analysis
Networking & Protocols13
OSI modelTCP/IPDHCPDNSHTTP/HTTPSICMPSSHTLS/SSLNAT802.11 / Wi-FiRoutingSwitchingSubnetting
Security Tools & Platforms10
LinuxKali LinuxApacheOpenSSLCisco Packet TracerWordPressSnortNetcatNmapwfuzz
Programming & Data5
PythonSQLRObject-oriented programmingDBMS security
Security Domains8
Risk analysisIncident responseAccess controlAuthentication / authorizationIntrusion detectionCryptographyPKICertificate management

Away From the Keyboard

Work and sport

All of this happened alongside being a full-time student. It's where a lot of my teamwork, reliability, and grace under pressure comes from.

Part-time Work4 roles

Server & Bartender

Zone 28 · Harmar, PA · Jun 2023 – Present
See more
  • Front-of-house server and bartender in a high-volume venue, working ~35–40 hrs/week alongside full-time coursework.
  • Manage multiple tables and competing, time-sensitive requests accurately under pressure.
  • Coordinate constantly with guests, kitchen, and management to keep orders correct and resolve issues fast.
  • Bartend VIP events and cover the main bar, and handle POS cash transactions.
  • Help train new servers and bartenders on menu, service standards, and POS operation.
  • RAMP certified for responsible alcohol service.

Kitchen Assistant

Ridgewells Catering · 125th U.S. Open, Oakmont · Jun 2025
See more
  • Kitchen assistant for Ridgewells Catering at the 125th U.S. Open: a one-week, ~60-hour stretch delivering white-glove service to roughly 650 guests per day in the 1895 hospitality tent.
  • Worked alongside event staff and culinary leadership to support premium operations where timing, accuracy, and presentation mattered.
  • Adapting quickly in a high-expectation, high-volume environment.

Server & Bartender

Over Eden · Lawrenceville, Pittsburgh · Apr – Aug 2025
See more
  • Handled service for large private events (corporate functions, weddings, and private parties), keeping timing and drink service on track and contributing to a positive experience for guests and teammates.
  • Kept quality high when plans changed fast, adjusting to unpredictable walk-in volume and shifting priorities in real time.
  • Read guest needs quickly and tailored recommendations to match, guiding choices and driving add-on sales.

Snowboard Instructor

Boyce Park Ski Area · Allegheny County · 2022–2024 · two seasons
See more
  • Taught beginners to snowboard in group and private lessons, breaking a complex physical skill into clear, repeatable steps for first-timers.
  • Adjusted coaching to each student's age, pace, and comfort level, building confidence while keeping lessons safe.
  • Kept groups of students safe and engaged on the slope, staying calm and organized in a fast-moving outdoor setting.

Athletics3 entries

Team USA Ball Hockey

Women's U20 National Team · Defense
2025 World Championship
  • Selected to the U.S. Women's U20 National Ball Hockey Team.
  • Represented the United States at the 2025 ISBHF U20 World Ball Hockey Championship in Poprad, Slovakia (July 2025).
  • Played defense as Team USA competed against national teams from Canada, Czechia, Slovakia, and Great Britain.

Ball Hockey: Club & Rec

Defense
See more
  • Team Pennsylvania (state select team): played 2021–2024 on the U16 and U19 teams.
  • NBHL (National Ball Hockey League): played 2024–2026 on men's and women's teams in Pittsburgh and Fairfax, VA.
  • Came up through youth dek hockey (Riverview) and Penn Hills Arsenal.
  • Jersey #18 retired by the Riverview Dek Hockey organization.

Penn State Women's Rugby

Wing · Junior · 2025–26
See more
  • Member of Penn State's women's rugby team (2025–26 varsity roster), playing wing.
  • Balances a full contact-sport season with a full course load and part-time work.
Roster profile

Honors & Involvement

2024 – 2026
Dean's List
Fall 2024, Spring 2025 & Spring 2026
2025
MSCI Scholarship
Metals Service Center Institute recipient
2023
NCWIT Aspirations in Computing
Rising Star Award
2022
NCWIT Aspirations in Computing
Affiliate Honorable Mention
Member
Women in Cybersecurity
WiCyS
3+ years
American Nuclear Society
Member
3+ years
Penn State Ski Club
Member
Volunteer
Logans Ferry Heights VFD
Community support & recordkeeping

Contact

Let's connect

I'm looking for cybersecurity internships and entry-level roles. The fastest way to reach me is email, and I'm always happy to talk about security, networks, or governance work.

paytonbrenner@gmail.com LinkedIn Resume (PDF)