🎯 Cybersecurity Engineer | Detection & Security Systems Engineer | Red & Blue Team Practitioner 📍 Kathmandu, Nepal 🇳🇵 🌐 krishnabk1.com.np • 💼 LinkedIn • 🐦 X / Twitter • 📧 hello@krishnabk1.com.np
I engineer software and defensive architectures at the intersection of offensive security, detection engineering, and resilient systems design. My philosophy is grounded in evidence-first security: simulate real-world adversarial tactics to uncover architectural blind spots, then build stateful detection pipelines, immutable audit mechanisms, and hardened access controls to eliminate them.
Every project in this portfolio is an operational, tested software artifact designed to demonstrate practical defensive capabilities, reproducible setups, clean architectures, and strict adherence to security standards (NIST SP 800-207, MITRE ATT&CK, RFC 9106, RFC 6238, and CISA KEV).
These five projects were selected through a documented, evidence-based portfolio audit evaluating code completeness, architectural depth, test coverage, and cybersecurity relevance.
| Project | Specialization | Architecture & Core Capabilities | Stack & Standards |
|---|---|---|---|
| 🛡️ Purple-Team Cyber Range | Adversary Emulation & Detection Validation | Multi-stage adversary emulation lab mapping Atomic Red Team attack simulations against defensive detections. Evaluates SIEM/EDR detection coverage across the MITRE ATT&CK matrix. | Python 3.12, Typer, SQLite WAL, MITRE ATT&CK |
| 🔍 Packet Analyzer | Network Traffic Analysis & DPI | High-performance pure-Python Deep Packet Inspection (DPI) decoding Ethernet II through DNS/HTTP. Features stateful 5-tuple flow tracking and protocol anomaly heuristic detection. | Python 3.12, Binary struct, Flow Tracking, DPI |
| ⚡ Mini SIEM | Autonomous SIEM & Threat Correlation | Lightweight security information and event manager. Ingests Syslog/CEF/JSON, executes sliding-window stream correlation, and synthesizes multi-stage incident alerts. | Python 3.12, FastAPI, SQLite WAL, Sliding Windows |
| 🤖 AI Security Operations Assistant | AI SecOps & LLM Guardrails | Autonomous SecOps copilot equipped with deterministic policy guardrails, prompt injection defenses (OWASP LLM Top 10), and automated incident triage reasoning. | Python 3.12, FastAPI, Guardrails, MITRE Mapping |
| 🔐 Crypto Learning Toolkit | Applied Cryptography & Failure Labs | Interactive applied cryptography platform demonstrating correct primitives (AES-GCM, RSA-PSS, ECC) alongside classic cryptographic failure labs (Padding Oracle, side channels). | Python 3.12, Cryptography, Math Labs, PQC |
The portfolio contains 35 verified cybersecurity projects organized across key engineering specializations:
- Mini SIEM — Autonomous stream correlation and incident detection engine.
- Security Log Correlation Engine — Multi-stage sliding-window log correlation and attack chain synthesis.
- Detection & Alerting Engine — Detection-as-Code engine with multi-channel alerting and dispatching.
- Security Log Analyzer — High-throughput forensic log parser with statistical anomaly scoring.
- Host Intrusion Detection System — Host telemetry monitoring for file, process, and socket anomalies.
- SOC Monitoring Platform — Operational SOC incident management platform with FSM lifecycle and SOAR playbooks.
- SOC Platform — Incident response orchestrator with entity triage and blast radius calculation.
- Packet Analyzer — Pure-Python multi-layer packet decoder and stateful session analyzer.
- Network Intrusion Detection System — Binary packet decoding, Snort-compatible rules, and flow state tracking.
- Network Security Toolkit — Modular network diagnostic, scanning, and interface assessment tool.
- Linux Firewall Manager — Declarative iptables/nftables state management and zone policy engine.
- Mini WAF — Reverse proxy Web Application Firewall with signature inspection and token-bucket rate limiting.
- Web Security Scanner — Asynchronous web vulnerability scanner for common OWASP Top 10 vulnerabilities.
- API Security Testing Lab — Intentionally vulnerable REST API lab demonstrating OWASP API Top 10 flaws and defenses.
- SQLi Detection Lab — AST and regex-based SQL injection detection engine and benchmark testbed.
- XSS Detection Lab — Multi-engine Cross-Site Scripting detector with HTML context sanitizer.
- Brute Force Detection Simulator — Authentication attack simulator with progressive rate-limiting defenses.
- Automated Vulnerability Assessment Platform — Network service vulnerability auditor cross-referencing CVE catalogs.
- Security Asset Discovery Platform — External Attack Surface Management (EASM), DNS enumeration, and TLS inspection.
- Ultimate Cybersecurity Lab — Multi-scenario offensive and defensive virtual cyber training range.
- Crypto Learning Toolkit — Production cryptographic primitives and failure vulnerability labs.
- Secure Authentication Service — Timing-invariant authentication with Argon2id and TOTP MFA.
- Zero-Trust Access Control Platform — NIST SP 800-207 engine with dynamic trust scoring and device-bound tokens.
- Zero Trust RBAC/ABAC REST API — Contextual authorization service with SHA-256 hash-chained audit ledger.
- JWT Security Analyzer — JSON Web Token vulnerability scanner detecting algorithm confusion and key misuse.
- Password Intelligence Analyzer — Entropy calculator and HaveIBeenPwned k-Anonymity breach checker.
- File Integrity Monitor — Baseline integrity verification system with cryptographic change auditing.
- Purple-Team Cyber Range — Adversary emulation lab with automated atomic testing and detection mapping.
- AI Security Operations Assistant — AI copilot with deterministic guardrails and SecOps triage logic.
- AI Phishing Detection System — Multi-modal phishing detection combining email forensics, NLP, and URL intelligence.
- Phishing URL Analyzer — Lexical, cryptographic, and heuristic URL threat classification engine.
- Malware Behavior Analysis Sandbox — Static pre-analysis, Shannon entropy profiling, and simulated process tracing.
- Malware Signature Analyzer — Binary fingerprinting and YARA-compatible pattern matching engine.
- Vulnerability Intelligence Manager — CVE/NVD intelligence feed ingestor with CISA KEV and EPSS risk scoring.
- Personal Security Toolkit — Modular desktop security utility for network audit and payload evaluation.
Core Languages: Python 3.12+ (Asyncio, Typing, Struct), Bash, SQL
Frameworks & APIs: FastAPI, Starlette, Typer, Rich, Pydantic v2, SQLModel
Security Standards: NIST SP 800-207, MITRE ATT&CK, RFC 9106 (Argon2id), RFC 6238 (TOTP), CISA KEV
Cryptography: Argon2id, AES-GCM, RSA-PSS, ECC (ECDSA/ECDH), HMAC, Hash-Chained Ledgers
DevSecOps & QA: Pytest, Pytest-Asyncio, Ruff, Mypy (Strict), Docker Rootless, GitHub Actions CI
Storage & Systems: SQLite (Write-Ahead Logging / WAL), Linux Kernel & Networking, Multi-stage Containers
I am always interested in discussing detection engineering, defensive systems architecture, applied cryptography, or cybersecurity engineering opportunities.
- 🌐 Portfolio & Blog: krishnabk1.com.np
- 💼 LinkedIn: linkedin.com/in/krishna1428
- 🐦 X / Twitter: @krishna1428
- 📧 Direct Email: hello@krishnabk1.com.np