Each project is framed around the problem, the implementation, and the outcome, with emphasis on delivery automation, infrastructure reliability, and practical cyber security operations.
Problem: Lab setup was manual, slow, inconsistent across machines, and missing a strong baseline for repeatable onboarding.
What I built: Reusable Docker templates, bootstrap scripts, and CI validation to standardize local environments and reduce setup drift.
Impact: Reduced setup time by about 70% and improved onboarding consistency with safer defaults.
Tech: Docker, Docker Compose, GitHub Actions, Linux, Bash/PowerShell
Problem: Migration work needed stronger rollout checks, less configuration drift, and clearer visibility into infrastructure changes.
What I built: Terraform-driven environments with GitHub Actions validation, plan review gates, and deployment checks for auditable releases.
Impact: Enabled more repeatable cloud cutovers with stronger pre-deploy confidence and cleaner governance.
Tech: Terraform, GitHub Actions, Azure, Linux
Problem: Security operations learning needed realistic host and network telemetry, alerting, and log analysis beyond theory-only exercises.
What I built: A personal SOC lab using Wazuh, Suricata, and Sysmon to practice event collection, host telemetry, network visibility, detection workflows, and log triage.
Impact: Strengthened hands-on security analysis skills and improved how I think about DevSecOps, monitoring, incident visibility, and detection coverage.
Tech: Wazuh, Suricata, Sysmon, Linux, SIEM/SOC
Problem: Service troubleshooting slows down when metrics, logs, and traces are inconsistent or missing altogether.
What I built: Dashboards, baseline alert rules, and early telemetry patterns to improve runtime visibility and support future tracing workflows.
Impact: Stronger service insight and a better foundation for alerting, incident response, and ongoing observability maturity.
Tech: Prometheus, Grafana, OpenTelemetry, Linux, Docker
Applying STRIDE threat modelling to my home SOC lab to identify attack surfaces, validate mitigations, and demonstrate structured security thinking.
| Threat Category | Scenario | Affected Component | Mitigation | Risk |
|---|---|---|---|---|
| S — Spoofing | Attacker spoofs a Wazuh agent identity to inject false telemetry | Wazuh Manager | Agent authentication keys; agent ID pinning in ossec.conf | Low |
| T — Tampering | Attacker modifies log files to evade detection and erase evidence | Sysmon / EVTX logs | Immutable log forwarding to Wazuh; integrity monitoring rules on log paths | Medium |
| R — Repudiation | No audit trail for SIEM admin actions (rule changes, alert suppression) | Wazuh Manager Admin UI | Sysmon EventID 11/13 tracks Wazuh config changes; all changes committed to Git | Medium |
| I — Info Disclosure | Log files contain cleartext credentials from monitored endpoints | Centralized log store | Log sanitisation rules; encrypted storage at rest; restricted RBAC access to log UI | High |
| D — Denial of Service | Agent flood overwhelms Wazuh analysis engine, dropping real alerts | Wazuh Analysisd | Rate limiting per agent; event queue monitoring; alert on queue overflow | Medium |
| E — Elevation of Privilege | Attacker gains root on SIEM host and disables detection entirely | Wazuh Server (Linux) | Minimal attack surface; SELinux enforcing; Suricata lateral movement detection; no direct internet exposure | High |
Method: STRIDE · Tools: Wazuh, Suricata, Sysmon, pfSense · Framework: MITRE ATT&CK