I sit on a team with threat hunting, detection engineering, and automation engineering. My lane is cloud and DevSecOps security: hardening AWS and CI/CD, writing the occasional detection, and assessing our own platforms the way an attacker would.
| Project | What it does |
|---|---|
| reaper |
JavaScript/TypeScript malware deobfuscation and triage. Static dead-code and obfuscation analysis plus a hardened Docker sandbox for dynamic runs. |
| wsmancer |
PSRP-native WinRM shell for offensive Windows work. NTLM/Kerberos message sealing, typed JSON output, sessions that survive dropped connections. |
| rummage |
TUI file picker and fuzzy finder library for Go, built on Bubble Tea. |
| dotfiles |
Idempotent, reversible workstation configurator for Linux and macOS, with dry-run and drift detection. |
| htb-hosts |
Sudo-free /etc/hosts manager for Hack The Box, as a CLI and a zero-dependency MCP server. |
Most of my infrastructure work lives in a private GitLab: about 100 Ansible roles and Terraform across 25+ repos running a segmented homelab.
- Zero standing privilege: Vault with default-deny, short-lived scoped tokens so automation and AI agents never hold admin credentials
- 15 segmented VLANs behind Suricata inline IPS; Headscale, Teleport (WebAuthn), and Authelia SSO for access
- An Active Directory attack range built from a Packer golden image, with Terraform and Ansible injecting repeatable misconfigurations
- Routers, DNS/DHCP, hypervisors, and services converge from Ansible and Terraform in CI
HTB CPTS · HTB CDSA · AWS Solutions Architect Associate · HashiCorp Terraform Associate · CompTIA CySA+ · CompTIA Security+