Security engineer building detection pipelines, security automation, and review tooling for emerging attack surfaces.
Exhibit / Detection-as-Code
Sigma source in. Validated Wazuh XML out.
detection:
selection:
Image|endswith: '\certutil.exe'
CommandLine|contains|all:
- 'urlcache'
- 'split'
condition: selection<group name="windows, custom_sigma">
<rule id="200001" level="10">
<!-- sigma_uuid:c8d8b9e5... -->
<if_group>sysmon_event1</if_group>
<field name="win.eventdata.image"
type="pcre2">
(?i).*\\certutil\.exe$</field>
<field name="win.eventdata.commandLine"
type="pcre2">
(?=.*(?i).*urlcache.*)(?=.*(?i).*split.*)</field>
<description>Suspicious Certutil Network
Connection</description>
<mitre><id>T1105</id></mitre>
</rule>
</group>The pipeline parses Sigma logic, preserves stable rule IDs, and validates the generated XML before deployment. Read the full case study or the stage-by-stage trace (opens in a new tab).
Selected work
A from-scratch Sigma-to-Wazuh compiler with validation gates, stable rule identity, and API deployment behind a dry run.
58 Sigma → 216 Wazuh rules
119 ATT&CK techniques, 14 tactics
87 automated tests
Captures MCP tool-call traffic and turns it into evidence a human reviewer can act on: bounded detections, trust-boundary inventory, and measured blind spots.
10 rules, 5 abuse techniques
4,727-record benign corpus
18 documented evasion classes
An Authentik SSO perimeter wired to Canarytokens and a Python enrichment service, built to study high-signal identity tripwires.
Authentik + Canarytokens
Flask webhook processor
AbuseIPDB enrichment, ARM64 lab
Writing
Isolating a HiddenAds infection with ADB, tracing the package, and reversing the APK in a Kali lab.
What Simple Cache preserves after history is cleared, and a Python workflow that extracts, hashes, and reports it.
Contact
I'm seeking junior security engineering roles and open to scoped MCP or detection-readiness reviews. Email gets a reply within two business days.