Network & Systems Engineer | Cybersecurity | AI Infrastructure
I build security tools, network monitoring systems, and AI-driven automation on real infrastructure.
| Project | Description |
|---|---|
| 🔍 Code Search API | Local semantic code search with Ollama embeddings, SQLite, and hybrid search. Language-aware chunking, LLM summaries, find code by intent. |
| 📘 OpenClaw Best Practices | Production runbooks: security hardening, multi-model orchestration, memory optimization, sub-agent patterns, backup/recovery |
| 📊 Usage Tracker | Token usage and cost analytics for OpenClaw sessions with multi-model breakdown |
| 📚 Prompt Library | Dual-mode prompt management with browse/copy UI and REST API for sub-agents |
| Project | Description |
|---|---|
| 🛡️ CyberBRIEF | AI threat intel briefing tool. BLUF reports, ATT&CK mapping, IOC extraction, multi-source research |
| 🔍 Bro Hunter | Threat hunting platform for Zeek/Suricata logs. Beaconing detection, DNS anomaly analysis, MITRE mapping |
| 🔬 Intel Workbench | Threat intel analysis with ACH matrix, cognitive bias checklists, evidence weighting, STIX export |
| 📖 Playbook Forge | IR playbook builder with visual flowcharts, execution engine, AI generation, and SOAR integration |
| 🏗️ S³ Stack | Full SOC architecture: MCP servers, detection pipelines, deployment playbooks |
| Project | Description |
|---|---|
| 🧠 Cortex MCP | Observable analysis: submit IOCs, retrieve reports, trigger response actions |
| 🛡️ Wazuh MCP | SIEM queries: agents, alerts, rules, decoders |
| 🔬 MISP MCP | Threat intel: search events, correlate IOCs, export STIX/Suricata/CSV |
| 🐝 TheHive MCP | Incident response: cases, alerts, tasks, observables |
| ⚔️ MITRE ATT&CK MCP | Map techniques, profile threat groups, analyze detection gaps |
| 🔎 Zeek MCP | Network monitoring: connection logs, DNS, HTTP, SSL |
| 🦔 Suricata MCP | IDS/IPS: manage rules, query alerts, analyze traffic |
| 🕸️ Maltego MCP | Author Maltego .mtgx graphs and run primitive OSINT lookups (whois/DNS/ASN/crt.sh) |
| Project | Description |
|---|---|
| 🔭 Watchtower | NOC dashboard with interactive topology, L2/L3 views, LibreNMS/Proxmox integration |
| 🔌 PortGrid | Switch port visualizer for LibreNMS with color-coded views and instant search |
| 🔒 ProxGuard | Proxmox firewall rule visualizer with conflict detection and rule simulation |
| 🐧 Samba AD Migration | Windows AD to Samba file share migration scripts for Proxmox |
| Project | Description |
|---|---|
| 📺 media-cli | Single-file bash CLI for the self-hosted media stack (Sonarr/Radarr/Prowlarr/qBittorrent/Bazarr/Jellyseerr/Tdarr). SSH + local modes, Tdarr boost control, qBittorrent malware hardening |
| 🎬 Jellyfin MCP | Control Jellyfin from LLMs: playback sessions, library scans, user admin, scheduled tasks, activity log — 20 MCP tools |
- Languages: Python (FastAPI), TypeScript (React, Next.js, Astro), Rust, SQL, Shell
- Infrastructure: Cisco IOS/IOS-XE, Dell PowerEdge, Proxmox, Fortinet, Juniper/Mist
- Security: Zeek, Suricata, Wazuh, TheHive, Cortex, MISP, MITRE ATT&CK
- AI: Claude, GPT, Gemini, MCP Servers, Ollama, OpenClaw, agent workflows
- Tooling: LibreNMS, Netdisco, Docker, Linux, Git