Design and deployment of a MITRE ATT&CK-based Purple Team program for an SOC MSSP, combining controlled real-world attack simulations (Atomic Red Team) with detection through an Elastic Stack infrastructure (SIEM/EDR). The project involves developing custom detection rules (KQL/EQL/Threshold), empirically validating them, and integrating an investigation and threat intelligence enrichment pipeline (TheHive, Cortex, MISP).

Development of a browser extension dedicated to securing executable file downloads (”foreign files”). The system implements a six-stage pipeline combining static analysis, dynamic analysis, malware analysis, and automated DFIR forensic artifact collection through a sandbox before execution on the user’s workstation, thereby strengthening system protection against threats.

Designed and implemented a CI/CD pipeline to automate APK ingestion, integrating a security scanning workflow that includes static analysis, SBOM generation, and vulnerability assessment using MobSF and specialized security tools.

Hardened a containerized Flask/SQLite application using Docker security best practices, including non-root execution, restricted capabilities, read-only filesystems, AppArmor/seccomp, and resource limits. Implemented network segmentation and deployed a monitoring stack using Docker Compose, Prometheus, Grafana, cAdvisor, Node Exporter, and Alertmanager.

A lightweight Linux-based penetration testing automation tool designed to simplify reconnaissance and security analysis tasks. It provides an interactive command-line interface to perform network scanning, vulnerability research, hash cracking, and security intelligence gathering.

A simple command-line tool to securely store and manage encrypted passwords locally. Offline, open-source, cross-platform (Windows & Linux). See README.md for usage and setup.