I am a cybersecurity student and hands-on security lab builder focused on enterprise-style security engineering. My work connects offensive testing, defensive monitoring, DevSecOps, Kubernetes security, cloud security, detection engineering, evidence handling, and professional security reporting.

I build projects the way real security teams work:

Find the weakness → prove it safely → document evidence → map impact
→ remediate or accept risk → retest → create professional reports

My goal is to grow into roles such as:

• SOC Analyst
• Detection Engineer
• DevSecOps Security Engineer
• Cloud Security Analyst
• Application Security / VAPT Analyst
• Kubernetes / Container Security Engineer
• Security Automation Engineer

I focus on practical cybersecurity labs that simulate real enterprise environments. I do not only run tools; I build full security workflows with evidence, reporting, remediation, and validation.

My work includes:

• SOC analysis, alert triage, and incident documentation
• Wazuh SIEM/XDR monitoring and detection validation
• Windows endpoint security using Sysmon and Windows Event Logs
• MITRE ATT&CK mapping for security events and detections
• Web application VAPT and API security testing
• Active Directory attack simulation and internal security assessment
• AWS cloud security assessment and misconfiguration testing
• DevSecOps security with CI/CD security gates
• Docker hardening and container image security
• Kubernetes security using Kind, RBAC, NetworkPolicy, Pod Security, and policy-as-code
• Supply-chain security using Trivy, Syft SBOM, Cosign, SLSA-style provenance, and OpenSSF Scorecard
• Runtime detection using Falco, Falcosidekick, Prometheus, and Grafana
• Evidence-backed professional PDF reporting, retesting, and remediation documentation

SOC Analysis
Detection Engineering
Wazuh SIEM/XDR
MITRE ATT&CK Mapping
Windows Endpoint Security
Web Application VAPT
API Security Testing
Active Directory Security
AWS Cloud Security
DevSecOps Security
CI/CD Security Gates
Docker and Container Security
Kubernetes Hardening
GitOps and ArgoCD
OPA Gatekeeper Policy-as-Code
Falco Runtime Detection
Prometheus and Grafana Security Observability
SBOM and Supply-Chain Security
Professional Security Reporting

Web VAPT | API Security | Active Directory | AWS Cloud Security

A full hands-on security assessment portfolio project covering multiple enterprise attack surfaces: web applications, APIs, internal Active Directory networks, and AWS cloud environments.

flowchart LR
    A[Define Assessment Scope] --> B[Build Lab Environment]

    B --> C[Web VAPT]
    B --> D[API Security Testing]
    B --> E[Active Directory Lab]
    B --> F[AWS Cloud Security Lab]

    C --> C1[Reconnaissance]
    C1 --> C2[Enumeration]
    C2 --> C3[Vulnerability Testing]
    C3 --> C4[Safe Exploitation Proof]
    C4 --> C5[Web VAPT Findings Report]

    D --> D1[API Endpoint Discovery]
    D1 --> D2[Authentication and JWT Review]
    D2 --> D3[Input Validation Testing]
    D3 --> D4[Broken Access Control Testing]
    D4 --> D5[API Security Report]

    E --> E1[Windows Domain Setup]
    E1 --> E2[SMB and Network Enumeration]
    E2 --> E3[Responder / Hash Capture]
    E3 --> E4[Kerberoasting / BloodHound Analysis]
    E4 --> E5[AD Attack Path Report]

    F --> F1[IAM Enumeration]
    F1 --> F2[S3 Access Review]
    F2 --> F3[EC2 IMDS Testing]
    F3 --> F4[ScoutSuite / Pacu Review]
    F4 --> F5[AWS Cloud Security Report]

    C5 --> G[Evidence Screenshots]
    D5 --> G
    E5 --> G
    F5 --> G

    G --> H[Risk Rating and Impact Mapping]
    H --> I[Remediation Guidance]
    I --> J[Professional Final Report]

• Built a structured Web VAPT lab using DVWA and Kali Linux
• Performed reconnaissance, enumeration, scanning, exploitation validation, and reporting
• Conducted API security testing using crAPI, Postman, JWT analysis, ffuf, Kiterunner, GraphQL, and OAuth request review
• Built an Active Directory attack lab with Responder, Hashcat, SMB validation, Kerberoasting, BloodHound, Pass-the-Hash, and DCSync testing
• Completed AWS cloud security assessment with IAM enumeration, Pacu, ScoutSuite, S3 access testing, IMDS credential exposure, cleanup, and billing verification
• Created professional PDF reports for assessment summaries, methodology sections, tool outputs, and evidence documentation
• Redacted sensitive values before GitHub publication

Web VAPT · API Security · Active Directory · AWS Security · Burp Suite · SQLMap · Postman · JWT · GraphQL · Responder · Hashcat · BloodHound · Impacket · Pacu · ScoutSuite · MITRE ATT&CK · Professional Reporting

CI/CD Security | Docker Hardening | Kubernetes Security | GitOps | Supply Chain Security | Runtime Detection

This is my most advanced security engineering project. It is an end-to-end private Enterprise DevSecOps Security Lab that starts with a deliberately vulnerable Flask application and secures it through CI/CD security gates, Docker hardening, Kubernetes controls, GitOps, supply-chain security, runtime detection, observability, compliance mapping, and professional reporting.

The project is designed to show how modern security teams secure software from code commit to runtime.

flowchart LR
    A[Developer Commit] --> B[GitHub Repository]
    B --> C[GitHub Actions Security Gates]

    C --> D[Bandit SAST]
    C --> E[pip-audit SCA]
    C --> F[Trivy FS / Secret / IaC Scan]
    C --> G[Docker Build]
    G --> H[Hardened Dockerfile]
    H --> I[Trivy Image Scan]

    I --> J[Container Registry]
    J --> K[Cosign Signature]
    J --> L[Syft SBOM]
    J --> M[SLSA-Style Provenance]

    B --> N[ArgoCD GitOps]
    N --> O[Kind Kubernetes Cluster]

    O --> P[RBAC]
    O --> Q[NetworkPolicy]
    O --> R[Pod Security]
    O --> S[OPA Gatekeeper]

    O --> T[Falco Runtime Detection]
    T --> U[Falcosidekick]
    U --> V[Prometheus]
    V --> W[Grafana Security Dashboard]
    W --> X[Detection Report + IR Runbook]

• Built a vulnerable Flask application with intentional SQL injection, command injection, unsafe rendering, dependency vulnerability, and missing security header scenarios
• Created unit and security regression tests using pytest
• Added GitHub Actions security workflows for SAST, SCA, Trivy scanning, hardened container validation, and OpenSSF Scorecard evidence
• Built a professional Dockerfile.hardened with multi-stage build, non-root user, Gunicorn runtime, OCI labels, healthcheck, minimal copy scope, and Kubernetes compatibility
• Added docker-compose.yml for local app execution, security scanning, SBOM generation, and monitoring support
• Created a Kind-based Kubernetes lab with hardened manifests
• Implemented Kubernetes security controls including namespace isolation, ServiceAccount least privilege, RBAC, NetworkPolicy, SecurityContext, resource limits, probes, and restricted workload design
• Added OPA Gatekeeper policy-as-code validation for admission control
• Implemented ArgoCD GitOps with desired-state sync, drift detection, and self-healing demonstration
• Added supply-chain security with Syft SBOM, CycloneDX/SPDX outputs, Cosign signing evidence, image digest tracking, and SLSA-style provenance
• Added Falco runtime detection with Falcosidekick, Prometheus metrics, Grafana security dashboard, and alert rule documentation
• Created detection engineering reports with MITRE ATT&CK mapping, trigger conditions, severity, false positives, triage steps, response steps, and evidence screenshots
• Created a full professional documentation package including project summary, methodology, findings, remediation examples, retest proof, threat model, compliance mapping, risk register, audit summary, post-mortem, and evidence index

DevSecOps · CI/CD Security · GitHub Actions · Flask · Python · Docker · Dockerfile Hardening · Kubernetes · Kind · ArgoCD · GitOps · RBAC · NetworkPolicy · Pod Security · OPA Gatekeeper · Trivy · Bandit · pip-audit · Syft · SBOM · Cosign · SLSA · OpenSSF Scorecard · Falco · Falcosidekick · Prometheus · Grafana · MITRE ATT&CK · OWASP ASVS · NIST SSDF · Compliance Mapping · Incident Response · Professional Reporting

An enterprise-style SOC monitoring lab using Wazuh SIEM/XDR, Windows endpoint telemetry, Linux monitoring, Sysmon, File Integrity Monitoring, vulnerability detection, and MITRE ATT&CK mapping.

flowchart LR
    A[Deploy Wazuh Manager] --> B[Connect Endpoints]

    B --> C[Windows Endpoint]
    B --> D[Linux Endpoint]

    C --> C1[Install Wazuh Agent]
    C1 --> C2[Enable Windows Event Logs]
    C2 --> C3[Integrate Sysmon Telemetry]
    C3 --> C4[Generate Controlled Suspicious Activity]

    D --> D1[Install Wazuh Agent]
    D1 --> D2[Enable Linux Monitoring]
    D2 --> D3[File Integrity Monitoring]
    D3 --> D4[Package / Vulnerability Visibility]

    C4 --> E[Alert Generated in Wazuh]
    D4 --> E

    E --> F[Alert Triage]
    F --> G[Event Timeline Analysis]
    G --> H[MITRE ATT&CK Mapping]
    H --> I[Severity and Impact Review]
    I --> J[Investigation Notes]
    J --> K[Evidence Screenshots]
    K --> L[SOC Analyst Report]
    L --> M[Future Detection Improvements]

• Deployed Wazuh SIEM/XDR in a local lab environment
• Connected Windows and Linux endpoints to the Wazuh Manager
• Integrated Windows Sysmon telemetry
• Generated controlled suspicious activity
• Reviewed alerts and security events
• Mapped activity to MITRE ATT&CK techniques
• Created SOC-style investigation notes, screenshots, and reports
• Documented future improvement areas including Windows Sysmon and Linux auditd monitoring

Wazuh · SIEM/XDR · SOC Analysis · Sysmon · Windows Logs · Linux Logs · MITRE ATT&CK · Alert Triage · Incident Documentation

A Windows-focused detection engineering lab built around custom Wazuh rules, Sysmon telemetry, Windows Event Logs, MITRE ATT&CK mapping, validation evidence, and analyst guidance.

flowchart LR
    A[Define Detection Objective] --> B[Select Telemetry Source]

    B --> C[Sysmon Logs]
    B --> D[Windows Security Logs]
    B --> E[Windows Defender Logs]

    C --> F[Create Detection Rule]
    D --> F
    E --> F

    F --> G[Deploy Custom Wazuh Rule]
    G --> H[Generate Controlled Test Activity]

    H --> H1[PowerShell Encoded Command]
    H --> H2[Local User Creation]
    H --> H3[Service Creation / Modification]
    H --> H4[Defender / EICAR Test]

    H1 --> I[Alert Validation]
    H2 --> I
    H3 --> I
    H4 --> I

    I --> J[Map to MITRE ATT&CK]
    J --> K[Review False Positives]
    K --> L[Tune Rule Logic]
    L --> M[Capture Alert JSON Evidence]
    M --> N[Document Triage Steps]
    N --> O[Detection Engineering Report]

• Built custom detection rules for Windows endpoint behaviour
• Used Sysmon and Windows Event Logs as telemetry sources
• Created detections for PowerShell encoded commands, local user creation, service creation/modification, and Defender/EICAR activity
• Mapped custom detections to MITRE ATT&CK
• Documented alert validation, rollback guidance, false-positive tuning, and triage notes
• Captured alert JSON evidence and dashboard screenshots

Detection Engineering · Custom Wazuh Rules · Sysmon · Windows Event Logs · MITRE ATT&CK · False Positive Tuning · Rule Validation · Rollback Planning

A packet analysis lab designed to capture and investigate controlled network attack traffic between Kali Linux and Metasploitable 2 using tcpdump and Wireshark.

• ICMP baseline ping traffic
• ICMP flood behaviour
• TCP SYN flood behaviour
• SSH brute-force traffic
• SMB enumeration traffic
• Wireshark Conversations analysis
• Wireshark Protocol Hierarchy analysis
• PCAP-based investigation workflow

Wireshark · tcpdump · Packet Analysis · Kali Linux · Metasploitable 2 · PCAP Investigation · Network Security · Attack Traffic Analysis

flowchart LR
    A[Build Private Attack Lab] --> B[Kali Linux Attacker]
    A --> C[Metasploitable Target]

    B --> D[Generate Controlled Network Traffic]

    D --> D1[ICMP Baseline Ping]
    D --> D2[ICMP Flood]
    D --> D3[TCP SYN Flood]
    D --> D4[SSH Brute Force]
    D --> D5[SMB Enumeration]

    D1 --> E[Capture Traffic with tcpdump]
    D2 --> E
    D3 --> E
    D4 --> E
    D5 --> E

    E --> F[Open PCAP in Wireshark]
    F --> G[Protocol Hierarchy Analysis]
    F --> H[Conversations Analysis]
    F --> I[Packet-Level Inspection]

    G --> J[Identify Normal vs Suspicious Patterns]
    H --> J
    I --> J

    J --> K[Document Indicators]
    K --> L[Create Screenshots]
    L --> M[Packet Analysis Report]
    M --> N[Detection and Prevention Notes]

Wazuh SIEM/XDR · Alert Investigation · Security Event Monitoring · SOC Triage · Incident Documentation · Evidence Handling · MITRE ATT&CK Mapping · Detection Documentation

Sysmon · Windows Event Viewer · Windows Security Logs · Windows Defender Logs · Custom Wazuh Rules · Rule Validation · False Positive Tuning · Endpoint Telemetry Analysis

DVWA · crAPI · Flask · FastAPI · Burp Suite · SQLMap · Gobuster · Nikto · WhatWeb · Postman · JWT Analysis · GraphQL · OAuth Review · Swagger Testing · API Authentication Testing

GitHub Actions · Security Gates · Bandit · pip-audit · Semgrep · Gitleaks · Trivy · Syft · SBOM · SPDX · CycloneDX · Cosign · SLSA · OpenSSF Scorecard · SAST · SCA · Secret Scanning · Container Image Scanning · CI/CD Security Documentation

Docker · Dockerfile Hardening · Kubernetes · Kind · kubectl · Helm · ArgoCD · GitOps · OPA Gatekeeper · Policy-as-Code · Admission Control · RBAC · NetworkPolicy · Pod Security · Non-Root Containers · Privilege Escalation Prevention · Linux Capabilities · Seccomp · Resource Limits

Falco · Falcosidekick · Prometheus · Grafana · Runtime Threat Detection · Detection Rules · Security Dashboards · Alert Rules · Triage Workflow · Incident Response Runbooks

Responder · Hashcat · NetExec · CrackMapExec · Impacket · Kerberoasting · BloodHound · Pass-the-Hash · DCSync Lab Testing · SMB Enumeration · Internal Network Assessment

AWS CLI · IAM Enumeration · CloudGoat · Pacu · ScoutSuite · S3 Public Access Testing · EC2 IMDS · Cloud Misconfiguration Review · Cloud Cleanup · Billing Verification

Wireshark · tcpdump · Nmap · Packet Capture · Traffic Analysis · ICMP · TCP · SSH · SMB · Service Discovery · Network Evidence Collection

I focus heavily on professional reporting because technical work is only valuable when it can be clearly explained, validated, and improved.

My documentation style includes:

Executive Summary
Scope and Rules of Engagement
Lab Architecture
Threat Model
Data Flow Diagram
STRIDE Analysis
Tool Output Summary
Evidence-Based Testing Table
Screenshot Mapping
Attack Methodology
Risk and Impact Analysis
MITRE ATT&CK Mapping
OWASP ASVS Mapping
OWASP Top 10 Mapping
NIST SSDF Mapping
CIS Kubernetes Benchmark Mapping
SLSA Supply Chain Alignment
SOC 2 Style Controls
ISO 27001 Style Controls
PCI/HIPAA Alignment Only
SBOM and Supply-Chain Evidence
Container Security Findings
Kubernetes Security Findings
Policy-as-Code Validation
Runtime Detection Reports
Incident Response Runbooks
Retest and Remediation Reports
Risk Register
Post-Mortem
Redaction and GitHub Safety Checklist
Appendix and References

flowchart LR
    A[Plan Scope] --> B[Build Lab]
    B --> C[Test and Attack Safely]
    C --> D[Collect Evidence]
    D --> E[Map Risk]
    E --> F[Remediate]
    F --> G[Retest]
    G --> H[Document]
    H --> I[Improve Controls]

flowchart TB
    A[Cybersecurity Learning Path] --> B[Web / API / Cloud / AD Assessment]
    A --> C[SOC Monitoring and SIEM]
    A --> D[Windows Detection Engineering]
    A --> E[Network Packet Analysis]
    A --> F[Enterprise DevSecOps Security]

    B --> G[Offensive Security Understanding]
    C --> H[Defensive Monitoring Skills]
    D --> I[Detection Engineering Skills]
    E --> J[Network Investigation Skills]
    F --> K[Secure SDLC and Cloud-Native Security Skills]

    G --> L[Evidence-Based Security Reporting]
    H --> L
    I --> L
    J --> L
    K --> L

    L --> M[Professional Portfolio for SOC / DevSecOps / Cloud Security Roles]