Security engineer
who ships.
Cloud security and DevSecOps for engineering teams: practical writing you can use the same week, and documented projects that show the work.
I embed security into every phase of the software delivery lifecycle — from threat modeling at design, to SAST/DAST in CI/CD, to least-privilege IAM in cloud, to detection engineering in production. I build in AWS, Azure, and GCP, and I automate everything I can with Python.
Field notes from the pipeline.
IAM & Identity Security
The First Login Happens Before Day One: Identity Proofing at the Hiring Door
IAM & Identity Security
They Don't Break In, They Log In: The Identity & Access Management Playbook
AI Security · Long Read
The New Insider: What 8 Years in Cloud Security Taught Me About the AI We're Now Letting Inside
Pragmatic security, not checkbox compliance.
I'm not here to sell you buzzwords. I'm a security engineer who builds — threat models, hardened pipelines, IAM policies, detection rules. I think in systems, not silos, and I can operate across the stack from code commit to cloud runtime.
What I Do
I secure cloud-native applications and infrastructure across the SDLC — from architecture review to production monitoring. I design IAM policies, harden CI/CD pipelines, build detection rules, and automate remediation. I work across AWS, Azure, and GCP.
How I Work
I start with the threat model, not the tool. I identify what needs protection, map trust boundaries, then select controls that match the risk. I automate repetitive security tasks so engineering teams stay fast without cutting corners.
What I'm Building Toward
A career at the intersection of cloud infrastructure and application security — helping engineering teams ship secure software faster. Every project in my portfolio maps to a real-world security problem with documented architecture and code.
End-to-end security coverage.
Organized by where security matters in the software delivery lifecycle — not just a list of tools I've touched.
Threat modeling using STRIDE and MITRE ATT&CK frameworks. Data flow analysis, trust boundary mapping, and abuse case development to identify design-level vulnerabilities before code is written.
Security scanning embedded directly into CI/CD workflows with automated quality gates. Static analysis for code vulnerabilities, dependency scanning for supply chain risk, and dynamic testing against running applications.
Least-privilege IAM policy design, service account governance, network segmentation, and cloud misconfiguration detection. Multi-cloud security posture management across AWS, Azure, and GCP.
Detection-as-code workflows with correlation rules mapped to MITRE ATT&CK techniques. Log pipeline architecture, alert tuning to reduce noise, and automated response playbooks using SOAR platforms.
Python-based tooling for IAM auditing, cloud configuration assessment, log analysis, and automated remediation. Reducing manual security toil through scripting and serverless workflows.
Securing containerized workloads from build to runtime — image vulnerability scanning, RBAC enforcement, network policy implementation, pod security standards, and runtime anomaly detection.
Documented. Architected. Executable.
Each project addresses a real security gap with a defined architecture, toolchain, and measurable outcome. Not tutorials — engineered solutions.
Microservices Threat Model & Security Control Map
Comprehensive STRIDE-based threat model for a microservices e-commerce platform — API gateway, authentication, payment, and order services. Mapped 23 threat scenarios across 5 trust boundaries with prioritized compensating controls and residual risk ratings.
Automated Security Gate Pipeline
End-to-end GitHub Actions CI/CD pipeline with four parallel security scanning stages — SAST via Semgrep with custom rule packs, container image SCA via Trivy, infrastructure-as-code validation via Checkov against CIS benchmarks, and DAST baseline scan via OWASP ZAP. PRs with CRITICAL or HIGH findings are automatically blocked.
AWS IAM Least-Privilege Audit & Remediation Engine
Python-based tooling using Boto3 and IAM Access Analyzer to programmatically audit IAM policies across an AWS organization. Detects over-permissioned roles, generates scoped-down policy recommendations, and produces before/after comparison reports with risk severity scoring.
Detection-as-Code: SIEM Correlation Pipeline
Elastic SIEM deployment with structured log ingestion from CloudTrail, VPC Flow Logs, and application telemetry. 15+ custom KQL correlation rules version-controlled as YAML in Git, each mapped to specific MITRE ATT&CK techniques with documented detection rationale and tuning methodology.
EKS Security Hardening & Runtime Threat Detection
Production-grade EKS cluster deployed via Terraform with defense-in-depth security — granular RBAC per namespace, deny-all-default network policies, restricted pod security standards, and Falco for runtime anomaly detection including container shell access and unexpected process execution.
Systematic, not reactive.
A repeatable security engineering workflow that integrates with — not blocks — the development lifecycle.
Assess
Identify assets, map data flows, define trust boundaries, and model threats using STRIDE before any implementation begins.
Embed
Integrate SAST, SCA, DAST, and IaC scanning into CI/CD pipelines with automated gates — security as a build step, not an afterthought.
Harden
Apply least-privilege IAM, enforce network segmentation, configure encryption at rest and in transit — no default credentials in any environment.
Detect
Deploy detection rules mapped to ATT&CK, tune alert thresholds, build response playbooks — structured detection logic, not alert fatigue.
Automate
Write Python tooling for IAM audits, compliance checks, and remediation workflows — eliminate manual toil, increase coverage.
Let's have a conversation.
Whether you're evaluating me for a role, exploring a security challenge, or looking to exchange ideas — I'm happy to connect.
Hiring / Role Discussion
For recruiters, hiring managers, and engineering leads evaluating fit for cloud security, DevSecOps, or security engineering positions.
Security Consultation
Discuss a specific cloud security architecture question, pipeline hardening approach, or detection engineering challenge.
Professional Networking
Open-source collaboration, content co-creation, mentorship exchange, or exploring mutual professional interests.
Connected to Google Calendar · Automatic email confirmations sent to both parties · Collects your name, email, phone number, and meeting context