Lab & Projects

To validate and operationalize the methodologies tested in the CompTIA CySA+ certification, I engineered a continuous virtual enterprise environment designed to simulate real-world attacks and execute incident response workflows.

Architecture & Deployment

• Deployed a centralized Wazuh SIEM manager to aggregate logs from multiple disparate endpoints (Linux/Windows).
• Configured Wazuh agents on vulnerable target machines to monitor file integrity (FIM), system calls, and authentication attempts.
• Simulated enterprise network segmentation and established secure SSH tunneling for administrative access.

Threat Detection & Log Analysis

• Utilized Kali Linux to execute controlled attacks against endpoints, including brute-force SSH, SQL injections, and privilege escalation scripts.
• Analyzed generated telemetry within the Wazuh dashboard, mapping alerts to specific MITRE ATT&CK tactics and techniques.
• Wrote custom detection rules in XML to reduce false positives and alert on specific indicator of compromise (IoC) patterns.

Currently expanding my home lab infrastructure to include a multi-forest Active Directory environment. The goal of this project is to deeply understand Windows enterprise architecture, how threat actors move laterally, and how to detect advanced persistent threats (APTs) at the endpoint level.

• Provisioning a Domain Controller and joining multiple Windows endpoints to simulate a corporate network structure with realistic Group Policy Objects (GPOs).
• Deploying Microsoft Sysmon across the domain to capture granular telemetry, process creation, and network connections.
• Simulating lateral movement and credential dumping (using tools like Mimikatz) to generate logs, then building Splunk dashboards to hunt for these specific behavioral anomalies.

Bridging my experience in GRC/IT Auditing with cloud infrastructure. This upcoming project focuses on identifying, auditing, and remediating cloud misconfigurations at scale.

• Utilizing Terraform (Infrastructure as Code) to deploy intentionally vulnerable storage accounts, virtual machines, and over-privileged IAM roles in Microsoft Azure.
• Mapping the deployed infrastructure against the Center for Internet Security (CIS) Microsoft Azure Foundations Benchmark to conduct a formal compliance audit.
• Integrating Azure Sentinel (Cloud SIEM) to detect unauthorized configuration changes and write automated remediation playbooks.

A capstone project aimed at maturing my SOC capabilities by transitioning from manual log analysis to automated orchestration and response.

• Integrating TheHive (Security Incident Response Platform) with my existing Wazuh SIEM to automate ticket creation for critical alerts.
• Writing Python scripts to interact with Threat Intelligence APIs (e.g., VirusTotal, AbuseIPDB) to automatically enrich observables (IPs, file hashes).
• Creating automated playbooks that interact with endpoint firewalls to isolate compromised machines without manual intervention, drastically reducing Mean Time to Respond (MTTR).

A comprehensive research project analyzing the human element of cybersecurity and enterprise risk management.

• The Core Thesis: Examined how declining foundational technical literacy expands the attack surface of an organization, directly leading to an increase in successful Business Email Compromise (BEC) and phishing campaigns.
• Risk Analysis: Researched the vulnerabilities inherent in modern Security Awareness Training programs, and how they fail to address the specific behaviors that lead to breaches.
• Policy Recommendations: Outlined strategic approaches for organizations to update data privacy governance and mitigate Insider Threats stemming from accidental negligence.