←Project_Database

Cybersecurity & Security Operations (SecOps)

Security Integration // PenTest / DFIR / SIEM / Cloud_Sec

Wazuh / SplunkNessus / NmapAWS / Azure CSPMSIFT / VolatilitySQLi / Pen TestingCyber Kill Chain

Overview

A multi-year Cybersecurity concentration spanning the full offensive and defensive lifecycle — from penetration testing and adversary simulation to SIEM-driven detection engineering, cloud security posture management, and post-incident digital forensics. The work pairs hands-on exploitation with the detection and response tradecraft of a modern Security Operations Center.

Major Projects

  1. 01

    Automated Cloud Security Auditing & CSPM Pipeline (Azure/Prowler)

    Microsoft AzureProwler WebAzure ADRBAC / IAMCIS BenchmarksJSON / HTML

    Overview // Engineered an automated Cloud Security Posture Management (CSPM) pipeline using Prowler Web to scan a Microsoft Azure environment, identifying misconfigurations and compliance gaps against CIS Benchmarks.

    • Secure API Bridge: Provisioned a dedicated App Registration within Azure Active Directory, generating secure cryptographic credentials (Client ID, Tenant ID, Client Secret) to establish an authenticated API bridge into the tenant.
    • Least-Privilege IAM: Designed and deployed a custom Identity and Access Management (IAM) role (Prowler-Role-Scanner) scoped strictly to read-only API actions (e.g. */read), enforcing the principle of least privilege.
    • Compliance Telemetry: Exported comprehensive compliance telemetry in JSON and HTML to track high-severity issues — such as missing activity-log alerts for critical infrastructure modifications.
  2. 02

    Enterprise SecOps & Threat Detection Dashboard (Wazuh/Splunk)

    Wazuh XDRSplunk CloudEDR AgentsUbuntu / WindowsPowerShellActive Response

    Overview // Engineered a centralized Security Operations Center (SOC) environment utilizing Wazuh and Splunk for unified telemetry, real-time analytics, and detection engineering.

    • Cross-Platform EDR: Deployed active EDR agents as continuous services across simulated Linux (Ubuntu) and Windows endpoints to ingest telemetry, monitor application vulnerabilities, and extract Windows Event Logs.
    • Adversary Simulation: Executed live adversary simulations — detonating malicious PowerShell payloads to validate SIEM alert generation and custom rule configurations.
    • Automated Active Response: Validated automated active-response capabilities, confirming the SOC pipeline could trigger and orchestrate countermeasures against detected threat behaviors in real time.
  3. 03

    Advanced Digital Forensics & Penetration Testing Assessment

    Kali LinuxSQL InjectionMD5 CrackingSIFT WorkstationVolatility / PlasoWireshark

    Overview // Executed a full-scope security assessment — from initial network footprinting through post-incident digital forensics — chaining offensive exploitation into defensive artifact reconstruction.

    • Web Exploitation: Exploited poor application input sanitization to extract backend database schemas via SQL Injection (SQLi), successfully cracking the exfiltrated MD5 credential hashes via dictionary and brute-force vectors.
    • Forensic Timeline Reconstruction: Deployed the SIFT Workstation to reconstruct digital timelines (Plaso/Log2Timeline), isolate malicious artifacts, and perform memory analysis with Volatility.
    • Traffic & Header Analysis: Reverse-engineered in-flight network traffic with Wireshark to analyze encrypted payloads and dissect spoofed email headers.

Skills Gained

SIEM & Endpoint Detection (EDR)

  • Deployed Wazuh XDR and the Splunk Cloud Platform for centralized log ingestion, real-time security analytics, and proactive threat hunting.
  • Administered cross-platform agents across Windows and Ubuntu endpoints and operationalized Windows Event Log monitoring.

Vulnerability Management & Pen Testing

  • Executed network footprinting and vulnerability assessments using Nessus, Nmap (via Kali Linux), and OpenVAS (GVM).
  • Conducted manual web application penetration testing (SQL Injection) and cracked MD5 password hashes using dictionary and brute-force vectors.

Cloud Security Posture Management (CSPM)

  • Architected native cloud security ecosystems within AWS (GuardDuty, Inspector, Macie) and Microsoft Azure.
  • Integrated open-source auditing tools (Prowler Web) utilizing Azure AD App Registrations and strict Role-Based Access Control (RBAC).

Digital Forensics & Incident Response (DFIR)

  • Deployed the SIFT Workstation for advanced forensic analysis, executing memory analysis with Volatility.
  • Generated super-timelines with Plaso/Log2Timeline and performed malware detection using Yara and ClamAV.

Threat Modeling & Adversary Simulation

  • Simulated PowerShell attacks to validate SIEM alerting and automated active-response capabilities.
  • Mapped real-world adversary behaviors against the Lockheed Martin Cyber Kill Chain and the NIST Cybersecurity Framework.

Network Protocol Security

  • Utilized Wireshark to dissect in-flight network traffic, comparing cleartext against encrypted payloads (SSH).
  • Analyzed Diffie-Hellman key-exchange negotiations to evaluate the confidentiality of secured channels.
←Project Archive