Cybersecurity Consultant specializing in AI Security, Governance, Risk & Compliance.
My work focuses on understanding and reducing security risk, with hands-on work across security operations, web security, threat intelligence and vulnerability management. I build practical security tools and document my work through reproducible experiments, technical analysis and educational resources.
Exchange hot wallets are a single point of failure, so do not keep more on an exchange than you are prepared to have delayed, move long-term holdings to your own wallet, secure your account with a passkey or authenticator app, and treat any "recovery" message or withdrawal link as a likely scam.
Most npm supply chain attacks push a poisoned version of a trusted package and run code at install time. Enterprise teams should test the firewall now; everyone else can get similar protection with lockfiles and npm ci, disabled install scripts, release-age delays and signature checks.
Triage and root-cause analysis of an alert indicating an obfuscated Base64 PowerShell execution spawned by Microsoft Office in an isolated Windows endpoint.
Root-cause analysis of an encoded PowerShell alert that fired at high severity, verifying legitimate Microsoft Configuration Manager (SCCM/MECM) hardware inventory automation, and authoring a tuned detection exclusion.
Investigation of over 12,000 failed SSH authentication attempts on an internet-facing Linux bastion host, identifying dictionary brute-force patterns and misconfigured firewall rules.
Dissection of an obfuscated SVG/HTML attachment designed to steal Microsoft 365 credentials through credential harvesting and iframe cloaking.
Analysis of network flow logs and Suricata NIDS alerts detecting horizontal TCP SYN sweep activity from an unauthorized development workstation.
Log analysis and triage of blind Boolean-based SQL injection attempts against a vulnerable plugin endpoint on a WordPress web server.
A dedicated virtualized SOC engineering environment with Windows 11 endpoints, Sysmon, Splunk Enterprise, and Atomic Red Team for detection rule testing.
A passive security auditing utility that analyzes HTTP response headers, TLS posture, DNS security records, and exposed technology banners.
A browser-native threat intelligence utility that parses, deduplicates, and defangs Indicators of Compromise from unformatted text and logs.
A structured audit framework and configuration template designed to harden production WordPress sites against common exploitation paths.
Passive assessment of website security posture including HTTP security headers, TLS observations, and DNS security records.
Evaluates individual HTTP response headers against current defensive best practices and provides remediation guidance.
Inspects URLs for heuristic risk factors such as suspicious TLDs, IP hosts, excessive subdomains, and obfuscated query strings without visiting the target.
Extracts, deduplicates, and defangs Indicators of Compromise (IPs, domains, hashes, URLs, CVEs) from raw logs and text.
Parses raw RFC 822 email headers to trace hop-by-hop Received latency, verify SPF/DKIM/DMARC authentication results, and flag display-name spoofing and envelope sender mismatches.
Search National Vulnerability Database (NVD) records, CVSS v3.1 vector metrics, and CISA Known Exploited Vulnerabilities (KEV) catalog entries.
Score your security operations team on people, process, data, tooling and AI governance, find your agentic SOC phase, and sort SOC tasks into AI agent quick wins, strategic investments, rule-based automation and tasks to avoid.
Check your readiness for ISO 27001 and GDPR across policies, risk, PII protection, access, training, suppliers, incidents and audit reporting, with every gap mapped to the clause or article it affects.
Build a cybersecurity risk register in your browser: score likelihood and impact on a 5x5 matrix, record inherent and residual risk, owners and treatments, view a heat map and export to CSV.
Binance suffered a massive cryptocurrency theft on October 29, 2026. Here's what we know about the breach, what remains unclear, and how to protect your crypto from hackers and increasingly convincing scams.
Protect your website infrastructure from crashing. Learn the 6 best defensive measures to block malicious traffic, implement rate limiting, and stop DDoS attacks before they cost you revenue.
A walkthrough of the exact triage workflow, event correlation steps, and command-line decoding techniques used to analyze suspicious PowerShell execution.
A concise reference guide to the most valuable Windows Event Log IDs for detecting account tampering, lateral movement, and privilege escalation.
Why modern web applications need CSP, HSTS, and X-Content-Type-Options, and how to configure them properly in Next.js and Nginx.
Practical techniques for parsing /var/log/auth.log, aggregating attacking subnets, and verifying whether key-only policies prevented breach.
A practical roadmap for moving a SOC to AI agents: build the data foundation, start with quick wins, customize and orchestrate agents, and keep humans in command.
Which SOC tasks should AI agents handle and which need a human? A function-by-function guide to automation potential, the AI role, the human role and the outcome.
Nine high-impact, low-effort SOC tasks to hand to AI agents first, what each agent does and the metric that proves it, plus the tasks to keep human.
Fake USPS, UPS, FedEx, DHL and Amazon delivery texts steal card details. Learn the red flags, what to do if you clicked, and how to report them.
Two critical PHP flaws allow unauthenticated remote code execution. See who is affected, the fixed versions, temporary mitigations and what to watch for in your logs.
Learn 5 signs your phone may be hacked, the innocent explanations, and how to check your Android or iPhone, secure your accounts and recover safely.
Eight eMudhra intermediate certificates were issued with private keys anyone can recover. Learn what that means, who is still exposed and the updates to install now.
Binance is investigating a suspected hot wallet hack. Here are 10 practical steps to protect crypto held on any exchange: account security, withdrawal limits, self-custody and scam awareness.
A minute-by-minute account of the October 2026 Binance hack: the EIP-7702 sweep, the freeze race, the "one laptop" explanation, the North Korea attribution and where the money is now.
GitHub launched a package firewall that blocks risky npm packages before they install. Learn how it works, who can use it and 10 steps any team can take today.
A practical guide to writing, approving and maintaining information security policies: the policy hierarchy, the core policy set, ownership, review cycles and how to prove people follow them.
A step-by-step ISO/IEC 27001:2022 implementation plan: scope, leadership, risk assessment, Statement of Applicability, Annex A controls, internal audit, management review and the certification audit.
A practical GDPR checklist covering data mapping, lawful basis, records of processing, PII protection, DPIAs, processor contracts, data subject rights, international transfers and 72-hour breach notification.
A step-by-step method for information security risk assessment aligned with ISO 27005 and NIST SP 800-30: assets, threats, likelihood and impact scoring, risk appetite, treatment and the risk register.
Build a security awareness and training program that changes behaviour: role-based content, phishing simulations done fairly, policy acknowledgement, metrics that matter and reporting to leadership.
How to prepare for an ISO 27001, SOC 2 or customer security audit: scope, control mapping, evidence collection, GRC platforms, mock audits, interviews and managing findings.
How to build compliance reporting that executives, boards, risk committees and clients can act on: the metrics to include, a one-page report structure, RAG ratings and decision requests.
A playbook for making every team understand its security obligations and follow through: control ownership, RACI, team scorecards, follow-up cadence, escalation and making compliance part of normal work.
Networking, operating systems, defensive security, security operations, and incident analysis.
LLM application security, prompt injection, model evaluation, agent security, and sensitive data protection.
Security controls, risk registers, compliance research, policies, and framework mapping.
Log analysis, datasets, threat research, experiments, and reproducible reporting.
AI security and GRC are the specialization. The foundation is hands-on work across the wider security field, each area backed by tools, labs or projects on this site.
Log analysis, alert triage, detection rules and incident documentation across Windows, Sysmon and Linux telemetry.
HTTP security headers, TLS and DNS posture, SSRF-safe tooling and WordPress hardening.
Indicator extraction and defanging, suspicious URL analysis and safe handling of incident data.
Phishing header analysis, SPF, DKIM and DMARC validation, and spoofing detection.
CVE research, CVSS interpretation and prioritization using the CISA Known Exploited Vulnerabilities catalog.
Prompt injection, AI agent permissions, risk registers and framework mapping to NIST AI RMF and ISO/IEC 42001.
Each study starts with a clear question, uses synthetic or public data, and publishes its method, evidence and limitations alongside the results.
How do different instruction-handling and tool-permission strategies affect the resilience of a small-business AI assistant against prompt injection?
What is the smallest practical set of governance controls a small business needs before relying on AI tools for customer-facing or decision-making work?
Which simple, explainable detection rules surface suspicious authentication activity in Linux and Windows logs with an acceptable false-positive rate?
A dedicated virtualized SOC engineering environment with Windows 11 endpoints, Sysmon, Splunk Enterprise, and Atomic Red Team for detection rule testing.
A passive security auditing utility that analyzes HTTP response headers, TLS posture, DNS security records, and exposed technology banners.
A browser-native threat intelligence utility that parses, deduplicates, and defangs Indicators of Compromise from unformatted text and logs.
A structured audit framework and configuration template designed to harden production WordPress sites against common exploitation paths.
Looking for hands-on exercises? The labs document detection and investigation practice in isolated training environments.
Passive assessment of website security posture including HTTP security headers, TLS observations, and DNS security records.
Evaluates individual HTTP response headers against current defensive best practices and provides remediation guidance.
Inspects URLs for heuristic risk factors such as suspicious TLDs, IP hosts, excessive subdomains, and obfuscated query strings without visiting the target.
Extracts, deduplicates, and defangs Indicators of Compromise (IPs, domains, hashes, URLs, CVEs) from raw logs and text.
Binance suffered a massive cryptocurrency theft on October 29, 2026. Here's what we know about the breach, what remains unclear, and how to protect your crypto from hackers and increasingly convincing scams.
Protect your website infrastructure from crashing. Learn the 6 best defensive measures to block malicious traffic, implement rate limiting, and stop DDoS attacks before they cost you revenue.
A walkthrough of the exact triage workflow, event correlation steps, and command-line decoding techniques used to analyze suspicious PowerShell execution.
Expertise in technology operations, digital analytics and automation that carries directly into security work:
Open to full-time employment, contract and consulting work across cybersecurity, with a lead focus on governance, risk and compliance: security policy, ISO 27001 and GDPR readiness, risk assessment, awareness training and compliance reporting.
Works remotely. Available for consulting, contract and full-time engagements worldwide.