New York City security researcher and cybersecurity analyst working on authorized assessments, AppSec, AI system security, and vulnerability research. I came to security through healthcare IT, systems administration, and embryology. That background taught me to check the evidence, record exactly what happened, and account for production impact.
I work from the attacker side in authorized labs and assessments, then turn the result into remediation and detection guidance another analyst can verify.
My current work centers on security research, vulnerability assessment, penetration testing, AppSec, and AI security. Recent projects include a 16-finding authorized AI/LMS assessment, a Kioptrix assessment with a validated path from unauthenticated access to root, and a source-backed NGINX exposure review.
My open-source work includes merged contributions to OWASP Nettacker, Atomic Red Team, Nuclei Templates, SigmaHQ, Splunk Security Content, and ActionScope. I like focused security-logic problems where a small change improves the accuracy or safety of a tool people already use.
| Area | Evidence |
|---|---|
| OWASP project | Nettacker PR #1659, synchronized 59 missing Russian locale messages, merged after full CI and merge-queue validation |
| Adversary emulation | Atomic Red Team PR #3354, corrected Mimikatz command quoting, merged |
| Vulnerability scanning | Nuclei Templates PR #16344, tightened a device-panel matcher to reduce false positives, merged |
| Detection logic | SigmaHQ PR #6038, corrected event-log-clear filter scope, merged |
| Detection content | Three merged Splunk Security Content contributions covering regex, AD comparison, and process-detection accuracy |
| Security tooling | ActionScope PR #34, improved missing-policy guidance, merged |
| Published tool | STIGPilot on PyPI with public source |
| Portfolio | srkyn.com with work archive, case studies, local browser lab, changelog, and security contact file |
| Project | Focus | Artifact |
|---|---|---|
| Directory Fieldbook | Active Directory attack paths built, tested, remediated, and retested in an isolated VMware lab | Case 001 |
| Kioptrix Vulnerability Assessment | Sanitized assessment with 24 findings and a validated path from unauthenticated access to root | Case study |
| Authorized AI/LMS Security Assessment | Sanitized case study from an authorized 16-finding assessment of access boundaries, tool behavior, memory, evidence handling, and redaction controls | Control matrix |
| NGINX Map Risk Audit | Source-backed exposure review with a configuration heuristic, patch validation, and Splunk and Defender hunting notes | Repository |
| KEV Prioritization Notes | Public exploited-vulnerability triage using CISA KEV data and documented prioritization criteria | Repository |
| STIGPilot | DISA STIG change triage, remediation backlog generation, evidence checklist planning, and ticket-ready exports | Chrome demo |
| Splunk Detection Content | SPL detections mapped to MITRE ATT&CK with analyst pivots, tuning notes, and triage playbooks | Playbooks |
| IdentityRiskGraph | CloudTrail IAM investigation with nested access paths, MITRE-mapped findings, and reviewable risk context | CloudTrail detector |
| OPNsense + Proxmox Security Control Plane | Firewall intent, DNSSEC, Quad9 DNS-over-TLS, CrowdSec, Proxmox LXCs, VictoriaLogs, NetAlertX, OpenCanary, live threat telemetry | Architecture |
TryHackMe: top 1% public profile, 120+ completed rooms across web security, Linux, network analysis, SOC alert triage, SIEM, Splunk, EDR, and CTF-style problem solving.
Affiliations: OWASP Foundation Individual Member · ISC2 Member
Website: srkyn.com · Email: contact [at] srkyn.com · LinkedIn: linkedin.com/in/srkyn
David Sarkisyan · Security Research · Vulnerability Assessment · New York City