I build practical security systems across detection engineering, security monitoring, cloud security, and DevSecOps, with hands-on experience across AWS, SIEM, security automation, and infrastructure security.
My work focuses on turning security telemetry into actionable detections, improving security visibility, assessing cloud environments, and integrating security controls into infrastructure and development workflows.
Wazuh SIEM, log-source onboarding, custom decoders, MITRE ATT&CK-mapped detection rules, alert triage, event correlation, and validation.
AWS security, IAM and least privilege, CloudTrail, Terraform, CI/CD security, OPA/Policy-as-Code, SBOM, SAST/DAST, and infrastructure hardening.
Practical security work with technical evidence, implementation details, and supporting documentation.
Problem: Improve automated analysis of security events using ML-based detection.
My role: Built the AI-driven threat detection system, including the detection pipeline, supporting application, monitoring, and deployment components.
Evidence: XGBoost classifier achieved 0.9931 F1 score with approximately 26 ms API latency.
Problem: Design a secure, repeatable AWS environment for a multi-service application.
My role: Worked across the Terraform architecture covering networking, ECS, ALB, RDS, Secrets Manager, and Amplify.
Solution: Modular infrastructure design with secure service connectivity, HTTPS, secrets management, policy enforcement, and GitHub Actions OIDC.
Problem: Centralize cloud and development telemetry for security monitoring and detection.
My role: Owned the monitoring and detection engineering workstream, including Wazuh integration, log analysis, custom decoders, detection rules, event correlation, testing, and validation.
Solution: Centralized Wazuh monitoring across AWS and development telemetry with detection logic mapped to relevant attack techniques.
Problem: Establish centralized visibility across endpoints, network activity, and cloud infrastructure.
My role: Worked across Wazuh, Suricata, FIM, detection scenarios, AWS CloudTrail integration, dashboards, and SOC investigation workflows.
Validation: Tested brute-force, network reconnaissance, privilege-change, and file-modification scenarios using resulting alerts and investigation workflows.
Problem: Assess AWS security weaknesses, determine risk, remediate findings, and validate the results.
My role: Conducted the assessment, documented findings and risk ratings, planned remediation, and performed post-remediation validation.
Key findings: EC2 exposure, public RDS, missing MFA, excessive IAM privileges, and disabled S3 public-access controls.
Focused walkthroughs that show how I approach security problems from telemetry and assessment through validation.
Detection logic, decoders, ATT&CK mapping, alert validation, and security telemetry.
SIEM monitoring, event correlation, investigation workflows, and SOC visibility.
AWS IAM, CloudTrail, network controls, security assessments, and remediation.
Terraform, CI/CD security, OPA, SBOM, SAST/DAST, secrets management, and secure infrastructure.