I run production SIEM, manage endpoint security and design secure networks, and I use a software background to automate the work.
Cybersecurity engineer working across SIEM, endpoint security and network design, with solid networking fundamentals and a software development background applied to security work. Comfortable across Linux and Windows infrastructure.
Listens to a doctor and patient and drafts the clinical note, ICD-10 codes and follow-ups during the appointment, not after it. I owned the five-agent architecture; the coding agent can only pick from a retrieved ICD-10 shortlist, so it can't invent codes.
A multi-VLAN SOC lab on Proxmox VE, segmented into five zones: attacker, DMZ, internal, management and Splunk. pfSense and Suricata IDS/IPS feed centralised logging in Splunk; now wiring Splunk to n8n agents that investigate logs and raise alerts on their own.
An on-prem, multi-tenant platform that gives a managed service provider one auditable record of every security tool across its clients: what's deployed, on which assets, under which licence, and where coverage is missing. Every change ties to a ticket and the audit trail is append-only.
LLM-driven optimisation of code and prompts. The security work is the sandbox for untrusted generated code: network-isolated containers, CPU and memory limits, read-only inputs, no shell execution and sanitised output.