I built and integrated security into three live platforms and maintain them part-time (about 1–3 hours a day): checking availability, troubleshooting technical and security issues, fixing identified flaws, and implementing owner-requested updates.

Personal projects and labs, not client deployments.

A multi-cloud detection pipeline that brings cloud and Kubernetes audit data into one investigation workflow.

• Ingests and normalizes events from AWS CloudTrail, Microsoft Entra ID, and Kubernetes audit logs
• Maps activity to MITRE ATT&CK
• Applies configurable YAML detection rules with severity and confidence scoring
• Exposes results through an API and a PostgreSQL/Supabase dashboard
• Generates recommended response actions

Scope: produces recommendations only; automated remediation is not implemented. ▶ Demo walkthrough

TypeScript Node.js Express React AWS SDK Azure Identity PostgreSQL Supabase

Microsoft Sentinel alerts drive Azure Logic App workflows that call AWS Lambda over OIDC, with no long-lived credentials. Confirmed working end-to-end in lab.

SOC Tier 3-inspired orchestration playbooks, iterated across many versions to explore alert enrichment, investigation, and controlled response.

• Threat-intelligence enrichment with VirusTotal and AbuseIPDB
• Integrations with Azure Key Vault, Service Bus, and ServiceNow
• Approval gates before sensitive identity-containment actions

Status: 🚧 In progress · Live development site

An AI-assisted investigation platform that brings multi-model orchestration, threat intelligence, and controlled tool execution into one workflow for URL and IP investigations. Instead of relying on a single model or an isolated reputation lookup, it coordinates five AI models and grounds their analysis in external evidence, while keeping control over which tools the AI can invoke.

• Multi-model orchestration: coordinates five AI models within the investigation workflow to explore how different models contribute to security analysis
• Threat-intelligence integration: VirusTotal, AbuseIPDB, Censys, ThreatFox, SecurityTrails, IPinfo, ViewDNS, Shodan, and Mozilla Observatory, added incrementally
• Controlled tool execution: a tool registry and tool-use policy define the available tools and govern how the agent invokes them, rather than allowing unrestricted execution
• Evidence-led assessments: tool calls gather observable intelligence, so findings rest on evidence rather than model assertions alone
• Structured output: results are organised so findings can be reviewed alongside their supporting evidence
• Access control: authentication, authorisation, and data-protection considerations built into the platform

JavaScript Node.js REST APIs Tool registry Policy enforcement Threat intelligence

Scope: under active development; integrations are subject to ongoing implementation and validation. It is not a fully autonomous SOC, a production-validated detection platform, or an automated remediation system.

Investigation of packet-capture evidence from a controlled lab, reconstructing a multi-stage attack. ▶ Video walkthrough

• Analysed HTTP, TCP, DNS, and SSH traffic in Wireshark
• Identified reconnaissance, SQL injection attempts, webshell upload, reverse-shell execution, and attempted unauthorised SSH access
• Extracted IOCs, built an event timeline, and mapped techniques to MITRE ATT&CK
• Documented evidence, methodology, and findings in a forensic report

Wireshark Gobuster SQLMap SHA-256 IOC extraction MITRE ATT&CK

Investigation of suspicious network activity and potential data exfiltration, using threat-intelligence enrichment, SIEM techniques, and MITRE ATT&CK mapping.

Educational lab exploring phishing campaign configuration and email delivery. Not an authorised engagement with any organization. ▶ Video demonstration

Training completed (not certifications): AWS Cloud Practitioner learning path (AWS Skill Builder, 2025) and AWS Solutions Architect Associate preparation (Udemy).

I run Lakewest Cybersecurity Academy, creating hands-on resources on SOC alert investigation, network forensics with Wireshark, and threat detection and incident-investigation methodology.