I investigate incidents, hunt for what alerts miss, and build detection content from the ground up across Microsoft Defender XDR, Wazuh and the ELK Stack.
Computer Science graduate (2025) with a completed SOC internship and hands-on detection engineering labs.
alerts correlated in one investigation
ATT&CK techniques executed and analyzed
endpoints onboarded via GPO and Intune
detection labs built end to end
A self built detection lab on Zorin OS running Wazuh SIEM, OpenSearch and TheHive case management behind an Nginx reverse proxy. Simulated a four stage web application compromise end to end, each stage independently detected, escalated and closed with a written verdict.
A browser game that teaches real security analyst skills through a branching investigation at a small managed security provider. Players work live cases with hands-on tools: a SIEM search language, a shell for log triage, a firewall rule editor, an admin console, a timeline builder, a passive DNS pivot board, a CVSS calculator, and detection-rule and incident-report writing. Built in TypeScript with Vite as a single self-contained HTML file that runs offline, no framework. Covered by 160 unit tests and a Playwright bot that plays every ending, with some cases generated fresh each run so the answers change.
A client-side encryption tool built with vanilla JavaScript and the Web Crypto API. Messages use hybrid RSA-OAEP + AES-256-GCM encryption, and saved results live in a vault encrypted with a key derived from your passphrase (PBKDF2, 600,000 iterations). A self-review found and fixed a stored XSS bug, plaintext storage and a hardcoded login, and a strict Content Security Policy blocks all network access. 38 automated tests check the crypto and click through the app in Chrome, Firefox and Safari's engine on every change.
A real time network scanner and firewall simulator built with Flask and Nmap. Supports TCP SYN, UDP and service version scans with live WebSocket updates. With admin or root rights, deny rules run a real netsh or iptables command for that IP and port, dropping matching traffic at the OS level, and allow rules win over deny rules on both Linux and Windows. Later added a scan diff that flags newly opened ports, auto-expiring blocks with an audit log, subnet and port-range rules, and fixed a command injection found in self-review. Also writes SIEM-ready events, tested on Wazuh 4.14.9: every scan, new open port and firewall change is logged in Elastic Common Schema, with custom Wazuh rules that alert on new exposure.
A cloud hosted security lab on Vultr built around the ELK Stack, with Sysmon deployed for endpoint telemetry, custom Kibana detection rules, adversary simulation via Mythic C2, and automated ticket creation on alert.
Team lead on a CNN, BiLSTM and GRU based intrusion detection model for IoT enabled healthcare systems, 99.8% detection accuracy, Grade A evaluation. Co-authored and published in IEEE Xplore, presented at DataSciMI 2026.
Read the paper →MITRE ATT&CK techniques I have worked hands-on across my detection labs and SOC internship, laid out by tactic. Select one to see the work behind it.
Vigil lab. Detected an SQL injection against a public web app in Wazuh, stage 1 of a 4-stage compromise.