What I've been building: detection pipelines, cloud security tooling, AI agents and a few useful apps.
A CI/CD pipeline that treats detection rules as code. It converts vendor-neutral Sigma YAML into Splunk SPL and Sentinel KQL through GitHub Actions, validates MITRE ATT&CK tags, deploys approved rules on merge to main, and routes live alerts to Jira through a Flask webhook. Ships with 6 Sigma rules.
A Python scanner that audits AWS against CIS Foundations Benchmark v1.5: IAM (MFA, wildcard policies, key rotation), S3 (public access, encryption, logging), security groups (open ports) and CloudTrail (multi-region, log validation, alarms). Produces risk-scored HTML and JSON reports with Jira integration.
Four autonomous security agents on a Brain-Bridge-Muscle architecture: a threat intel awareness agent (VirusTotal, OTX, CISA), a phishing detection workflow (n8n and Gmail), a WebSecScan auditor for the OWASP Top 10, and an MCP cyber agent for autonomous incident response.
An n8n and FastAPI pipeline that ingests Gmail alerts, analyzes suspicious URLs through URLScan.io and VirusTotal, and scores severity. Critical (75 to 100) triggers auto-quarantine and a Slack alert. High (50 to 74) goes to manual review.
Custom Splunk ES dashboards that map log data to MITRE ATT&CK technique IDs, with an ATT&CK heatmap, lateral movement detector, statistical C2 beaconing analyzer, UEBA anomalies, failed login tracker and privilege escalation monitor. Powered by Sysmon and Windows Event Logs.
A Python pipeline using behavioral analytics to identify credential stuffing, account takeover and anomalous payment activity. It integrates with a SIEM for alerting, and its scoring engine flags high-risk sessions with configurable thresholds and auto-triage workflows.
A framework for vulnerability scanning, IAM policy enforcement and secrets management. A Python scanner flags misconfigured roles, exposed secrets and open attack surface, while Terraform and GitHub Actions enforce least-privilege guardrails in CI/CD and generate a remediation report per finding.
A pipeline that automates SOC 2 control evidence collection and validation with Python and GitHub Actions. KQL-powered monitoring tracks control health through a SIEM, and automated evidence packages surface control gaps before audit windows.
Machine-enforceable guardrails for AWS, Azure and GCP using Terraform and GitHub Actions. A policy engine blocks non-compliant infrastructure before deployment, and reporting surfaces violations by control family (NIST CSF, CIS, SOC 2) with remediation playbooks.
A virtualized lab enforcing microsegmentation across VLANs with mutual TLS, an identity-aware proxy (OpenZiti) and a least-privilege policy engine (Cisco ISE and OPA). Validated against insider threat, east-west lateral movement and credential theft scenarios, with PKI through Step-CA.
Architecture for a cyber-physical tracking system securing construction materials from Berbera port through the Ethiopia corridor. Covers GPS spoofing defense, RFID clone prevention with rolling cryptographic codes, Zero Trust VPN tunnels between checkpoints, and digital Bill of Lading security.
A FastAPI and LangChain service that ingests feeds from NVD, AlienVault OTX and CISA KEV, then applies NLP classification to rank threats by urgency, sector relevance and exploitability. Returns enriched CVE analysis with CVSS scores, exploitation status and recommended actions.
A retrieval-augmented system that ingests 10-K filings from EDGAR and answers natural language questions about cybersecurity risk disclosures, using semantic search over relevant sections. Exposes a REST API with ingest, query and search endpoints.
A multi-agent pipeline with four agents: a scraper for job boards, an analyzer that gives an NLP fit score from 0 to 100, a tailor for keyword-matched resume bullets and cover letters, and a tracker that logs to Notion. Orchestrated with LangChain.
A complete pentest against Metasploitable 2, demonstrating the VSFTPd 2.3.4 backdoor, Samba MS-RPC shell, UnrealIRCd backdoor, DVWA SQL injection, Tomcat manager upload, distcc RCE and PostgreSQL RCE. Includes an automated Metasploit runner, post-exploitation scripts and a findings report template.
A scheduler that fills each role's required coverage hour by hour from staff availability, balances hours toward weekly targets, supports split shifts, and calculates weekly payroll with overtime at 1.5x after 40 hours.
A study app for the New Jersey MVC knowledge test, with flashcards, 10-question quizzes, topic drills and a 50-question mock test using the 80% pass mark.