Cybersecurity undergraduate focused on detection engineering, cloud security, and security automation. I design, build, and document defensive systems end to end, telemetry pipelines, behavioral detections, and automated incident response, as reproducible IaC, then validate them with adversary emulation.

CompTIA Security+ certified. CySA+ in progress. Graduating 2028.

• Detection Engineering — behavioral and signature-based detections, alert tuning, false-positive reduction, MITRE ATT&CK mapping
• Cloud Security — AWS and Azure telemetry, IAM analysis, audit logging, threat detection
• Security Automation / SOAR — orchestrated, auditable incident response with human-in-the-loop controls
• Incident Response — triage, containment, forensic evidence capture, runbook development
• Infrastructure-as-Code — reproducible security infrastructure built and torn down with Terraform

• CompTIA Security+
• CompTIA CySA+ (in progress)

A behavioral detection-and-response pipeline built entirely on native AWS services and managed with Terraform. It learns each IAM principal's normal behavior, flags activity that deviates from that baseline, and runs an automated, human-gated incident response playbook, containment, forensic evidence capture, notification, and incident ticketing.

• Per-principal behavioral baselining with ASN enrichment and a warm-up guard, backed by DynamoDB
• Six-step Step Functions playbook with a native callback-token human-approval gate
• Detections and responses mapped to MITRE ATT&CK for Cloud and D3FEND
• SOC-style runbooks and a full architecture diagram included

View repository →

A full vulnerability-management-lifecycle lab, from discovery through verified remediation, simulating a covert C2 channel tunneled through DNS, a technique that evades perimeter controls because firewalls rarely inspect DNS contents.

• Five-VM isolated lab on Apple Silicon (pfSense, Windows victim, BIND9 resolver, Kali attacker, Wazuh SIEM)
• Discovered via internal red-team simulation, scored with CVSS 4.0, mapped to ATT&CK T1071.004 and T1572
• Four-control defense-in-depth remediation aligned to NIST SP 800-40r4 and the CISA Vulnerability Management Lifecycle
• Custom Suricata rules, BIND9 Response Policy Zones, manual ARM64 Wazuh stack, and Slack alerting, with end-to-end remediation verification

View repository →

Cloud & SOC

SIEM & Detection

Automation & Infrastructure-as-Code

Network Security

Adversary Emulation & Detection Validation

Frameworks & Standards