Detection Engineering • Cloud Security • Threat Hunting
B.S. Information Technology • M.S. Cybersecurity & Information Assurance
Los Angeles, CA •
Email •
LinkedIn
Cybersecurity professional with hands-on experience designing and implementing enterprise-style Detection Engineering, DevSecOps, SIEM, Active Directory, and AWS Cloud Security projects focused on threat detection, security automation, continuous compliance, and incident response.
- Detection Engineering
- Threat Hunting
- Security Monitoring & Incident Detection
- SIEM Engineering
- Cloud Security
- DevSecOps
- Infrastructure as Code
- Windows Endpoint Telemetry
- CompTIA PenTest+
- CompTIA CySA+
- CompTIA Security+
- AWS Certified Cloud Practitioner
- ITIL 4 Foundation
- CompTIA Network+
- CompTIA A+
- LPI Linux Essentials
Wazuh · Splunk · Sysmon · Elastic Stack
AWS (IAM, S3, Lambda, CloudWatch, SNS, EventBridge, CloudTrail, AWS Config, ECR)
Terraform · GitHub Actions · Checkov · TFLint · Python
Windows · Linux · PowerShell · Bash
Wireshark · MITRE ATT&CK · Git/GitHub
Designed and implemented a detection engineering lab using Wazuh and Sysmon to create custom detections for PowerShell execution, user account creation, and privileged group membership changes mapped to MITRE ATT&CK techniques.
- Detection Engineering
- Threat Hunting
- Custom SIEM Rule Development
- Windows Security Monitoring
- MITRE ATT&CK Mapping
Wazuh · Sysmon · Windows 10 · Ubuntu Server
Designed and implemented an event-driven AWS DevSecOps pipeline that provisions secure cloud infrastructure using Terraform, validates Infrastructure as Code through GitHub Actions, Checkov, and TFLint, continuously monitors Amazon S3 compliance using AWS Config, and automatically remediates insecure cloud configurations with AWS Lambda and Amazon EventBridge.
- Cloud Security Engineering
- DevSecOps
- Infrastructure as Code
- Continuous Compliance
- Security Automation
- Event-Driven Architecture
- Least Privilege IAM
Terraform · GitHub Actions · Checkov · TFLint · AWS Config · Amazon EventBridge · AWS Lambda · Amazon S3 · CloudWatch · IAM · Python
Designed and implemented an enterprise Active Directory environment with a Windows Server domain controller, Windows 11 endpoint, Sysmon, and Wazuh to simulate identity attacks, privilege escalation, and security monitoring workflows.
- Active Directory
- Identity Security
- Windows Security
- Threat Detection
- SIEM Monitoring
Windows Server 2022 · Windows 11 · Active Directory · Sysmon · Wazuh
Built a Detection-as-Code pipeline using Sigma rules and GitHub Actions to automatically validate detection content before deployment, demonstrating modern security engineering workflows and CI/CD integration.
- Detection Engineering
- Detection-as-Code
- CI/CD
- Security Automation
- Sigma Rule Validation
GitHub Actions · Sigma · Python · YAML
Built a serverless malware scanning solution that automatically scans files uploaded to Amazon S3 using ClamAV running inside containerized AWS Lambda functions. The solution identifies malicious files, applies security tags, and generates automated notifications through Amazon SNS.
- Cloud Security
- Security Automation
- Malware Detection
- Serverless Security
- AWS Security Monitoring
AWS Lambda · Amazon S3 · Amazon ECR · Amazon SNS · CloudWatch · Docker · Python · ClamAV
Designed and implemented a SIEM detection lab focused on identifying and investigating SSH brute-force activity through centralized log collection, dashboards, and security monitoring workflows.
- SIEM Monitoring
- Log Analysis
- Incident Investigation
- Authentication Monitoring
Splunk · Linux · SSH · Syslog
Built a serverless security monitoring solution leveraging AWS Lambda, CloudWatch, and Amazon SNS to automate event collection and alerting.
- Cloud Monitoring
- Event Logging
- Security Alerting
- AWS Services
AWS Lambda · CloudWatch · Amazon SNS · IAM
- Linux User Management Script
- AWS Serverless Security Logger
- Splunk SSH Brute Force Detection Lab
- AWS Serverless Malware Scanning Pipeline
- Wazuh Detection Engineering Lab
- Active Directory Attack & Defend Lab
- Detection-as-Code Pipeline
- AWS DevSecOps & Automated Cloud Remediation Pipeline
- SOC Analyst
- Security Analyst
- Cybersecurity Analyst
- Security Operations Analyst
- Detection Engineer
- Security Engineer
- Cloud Security Engineer
- DevSecOps Engineer
- Senior Cloud Security Engineer