Building toward API Security Engineering — securing the connections between systems that power modern enterprise infrastructure. Eight years in technology operations at Synchrony, an M.S. in Cybersecurity at NYU, and a portfolio of security tools built from scratch at the intersection of application architecture and threat intelligence.
Security tools built from scratch — live, deployed, and field-tested.
Full-stack OSINT intelligence aggregation platform. 17 files, 1,434 lines, 5 API routes in production. Integrates HIBP, Shodan, Hunter.io, AbuseIPDB, VirusTotal, crt.sh, WhoisJSON, IPQualityScore, and GitHub into a unified analyst interface with an executive design system.
React + Vite IP intelligence tool with Mapbox GL JS geolocation, AbuseIPDB threat scoring, and real-time visitor IP detection.
Enterprise SIEM — live Sentinel workspace, custom KQL detection rules mapped to MITRE ATT&CK Initial Access, and triaged real triggered incidents.
Graph-based fraud investigation tool using Neo4j. Surfaces shared device clusters, transaction loops, and duplicate patterns via graph traversal and anomaly scoring.
API-driven identity correlation — unifies LenelS2 OnGuard physical access with Active Directory and SSO for real-time identity resolution and SIEM enrichment.
LangChain + FAISS + HuggingFace all-MiniLM-L6-v2 + GPT-4o-mini. Six curated SOC knowledge packs — answers pulled from curated documents, not general training data. Live on Streamlit Cloud.
Live AWS environment using GuardDuty, CloudTrail, and SNS alerting. Simulates real attack scenarios — credential stuffing, S3 exposure, IAM abuse — each mapped to MITRE ATT&CK with a triage runbook.
Deception-based detection using planted IAM credentials, S3 objects, and EC2 keypairs. Any access triggers a CloudTrail → Lambda → SNS pipeline with full context alerting.
IaC provisioning a secure AWS environment — VPC, least-privilege IAM, locked S3, CloudTrail logging, GuardDuty. Redeployable in minutes.
Apple Watch + iPhone app leveraging HealthKit and Dexcom CGM integration. Four-layer architecture with Claude API-powered coaching for personalized health prevention guidance.
Live demonstrations of AI tools I've built — from SOC analyst assistants to RAG pipelines and agentic workflows.
Ask anything about phishing triage, Splunk SPL hunting queries, MITRE ATT&CK mapping, AWS CloudTrail events, or IAM fundamentals. Answers are pulled from curated SOC knowledge packs, not general training data.
▶ Launch Live App →Opens in new tab · Selectable knowledge packs · Evidence sources · Conversation history
How the SOC RAG Assistant processes your question — from raw text to structured analyst guidance:
Key innovation: instead of relying on the LLM's general knowledge, it only answers from curated documents — making responses accurate, auditable, and domain-specific.
Ask about DNS tunneling, phishing response, or ransomware triage:
8+ years across IT operations, enterprise security, and AI enablement in regulated and high-volume environments.
Security engineering depth across API design, threat intelligence, and enterprise infrastructure.
Active certifications and completed training programs.
Strong academic record across three institutions.
Building toward API Security Engineering. Open to roles, conversations, and collaboration at the intersection of API architecture and security.