I build and operate the security infrastructure organisations depend on — from architecting enterprise SIEM platforms and writing detection logic that fires on real threats, to hardening cloud environments on AWS with IAM guardrails, automated compliance, and infrastructure-as-code. Full-stack security: platform, detection, and cloud.
Platform engineering, detection logic, cloud security, and offensive validation — across the full security lifecycle.
Enterprise-scale SIEM across multi-cloud environments — designed for resilience, multi-site, and the volume real SOCs run at.
200+ detection rules mapped to MITRE ATT&CK using PCRE/PCRE2 — cutting noise, raising coverage by 45%, and driving threat hunting operations.
Hardened, multi-account AWS environments built entirely in code — IAM guardrails, centralized logging, GuardDuty, and automated compliance. Patterns that travel across clouds.
End-to-end IR from detection through containment — memory forensics with Volatility3, IOC extraction, root cause analysis, and post-incident reporting at a 98% SLA.
A clear progression from infrastructure operations to enterprise security engineering and cloud architecture.
Production-grade security engineering work — from cloud infrastructure to defence frameworks.
A production-grade, multi-account AWS security environment built end to end in Terraform. Two-account organisation (Security + Dev) with centralised logging, continuous IAM audit, and preventative guardrails that block dangerous actions before they happen — every resource defined as code.
A unified cyber defence framework purpose-built to act as a coordination layer for SOC operations — integrating threat detection, intelligence correlation, and response orchestration across distributed environments. Designed to bridge the gap between raw telemetry and actionable defence.
Peer-reviewed journals, official product documentation, and technical deep-dives — read by security teams worldwide.
Skills and tools accumulated across 6+ years of security engineering, research, and infrastructure roles.
Validated expertise across security operations, cloud architecture, and network security.