Defensive security & infrastructure protection. I harden production systems, cut attack surface,
hunt for what shouldn't be there, and turn findings into clear, actionable remediation.
IT Infrastructure & Security Engineer with 5+ years of hands-on experience across cybersecurity, network & systems administration, server infrastructure, and software deployment. I take ownership of production environments end-to-end — from deployment and administration to hardening, monitoring, and incident response.
- 🔍 Security Operations — SIEM, log analysis & forensics, threat detection, incident investigation, MITRE ATT&CK
- 🧱 Infrastructure Hardening — CIS benchmarks, attack-surface reduction, vulnerability management, backup & DR
- 🌐 Network Security — Zero-Trust overlays (Headscale/WireGuard), VPN, firewalling, TCP/IP, Wireshark
- 🕵️ Threat Intelligence — OSINT, exposure assessment, attack-surface analysis, data-leak monitoring
- ⚙️ Automation & IaC — Bash, Python, Docker, Terraform, Ansible, k3s, AI agents
📜 Actively certifying toward CompTIA Security+ · Blue Team Level 1 (BTL1) · eJPT
Security & Blue Team
Infrastructure & Networking
Automation & IaC
A Wazuh SIEM cluster running behind a private Headscale overlay for secure, encrypted log ingestion and real-time monitoring.
- Custom alerting rules & log-analysis pipelines detecting anomalous behavior, brute-force attempts, and unauthorized system changes
- Exposure assessments to validate existing controls and incident-response readiness
Owned a live production environment for a travel agency.
- Engineered a hardened Linux environment with rigorous access controls and service minimization
- Deployed Zero-Trust networking (Headscale) for encrypted, authenticated admin access
- Remediated critical web vulnerabilities via dependency lifecycle management and emergency patching
📋 CIS Benchmark Audit — Ticket To The Moon (Contract, 2026)
- Audited external-facing infrastructure across web and VPS environments
- Identified system-hardening gaps and high-risk findings
- Delivered structured reports with prioritized remediation roadmaps for technical and business stakeholders
🧪 Command Injection & WAF Evasion Research — cmdi-waf-evasion
- Reusable methodology for authorized bug-bounty / pentest work: OS command injection, path traversal / LFI, filter-bypass thinking
- Techniques to distinguish genuine bypasses from SPA-fallback / soft-404 noise
Production web projects I've built, deployed, and maintained for real businesses:
| Project | What it is | Live |
|---|---|---|
| EcoSpark Solutions | Licensed electrician, Fremont & the Bay Area (USA) | ecosparkelectric.com |
| Beyond Bali Tours | Travel agency platform (Odoo ERP + custom module) | beyondbali.tours |
| Puri Tomato | Business website | puritomato.com |
| Jero Farm | Business website | jero.farm |
Most of my work lives in private & client repositories, so public stats only tell part of the story.
Defensive security · Infrastructure hardening · Always learning.