Portfolio
Three projects showing how I approach telemetry normalization, detection logic, cloud security controls, infrastructure-as-code, validation, and engineering tradeoffs.
Cross-platform collectors and normalizers produce a common SecurityEvent representation consumed by a C# detection engine. Current detections include brute force, port scanning, account creation, group membership changes, and correlated privilege escalation sequences.
Case study →Python parser and extensible detector registry for security-relevant CloudTrail API activity, validated with controlled Terraform-generated ground truth.
Case study →A reproducible AWS environment using IAM role separation, Systems Manager administration, VPC networking, EC2, and controlled telemetry for detection validation.
Case study →