I'm Rasheed Farhat. I work in detection engineering and security operations, from Rochester, Minnesota. Most of what I build ends up in the same shape, a system that has to produce evidence for its own output before anyone is allowed to act on it.
A detection is one part of a control. I build the inputs, validation, approval, and failure handling around it, then document them so another engineer can follow the path. Control Plane exists because the handoffs between those parts are where operations actually break.
I prefer a bounded, reproducible result to a broad one. Corpus limits and evasion gaps are published next to the numbers they qualify.
The identity deception case study lists its own webhook authentication and source-attribution gaps. I found both while writing the page up, and the page went out with them in it.
Every project ships with the trace, the threat model, or the report another person needs to verify or challenge the result.
Detection-as-Code, an approval-gated operations control plane, MCP security review, identity deception, and a published Android malware investigation.
Security+ active October 2025 to October 2028. CySA+ active May 2026 to May 2029.
Incident detection, containment, and escalation with Falcon EDR, Splunk, and Wireshark in simulated red-team and blue-team scenarios.
Timed OSINT, network traffic, log review, cryptography, and incident-handling challenges. Top 1 percent nationally across the Spring and Fall 2024 seasons.
Dean's List, and the ISACA Foundation NCL Games Scholarship.
Outside of work and security projects, you'll find me playing a chess game or lifting some weights. I also enjoy listening to podcasts ranging from health to comedy and philosophy.
Junior roles in detection engineering, security automation, SOC engineering, or cloud and application security, where I can own detection content and the systems around it.