Projects & Labs

A serverless, event-driven pipeline on AWS that monitors account activity logs and automatically flags suspicious or high-risk behavior. CloudTrail logs land in S3, which triggers a Python Lambda that runs six custom detection rules across authentication, IAM, privilege escalation, and public-resource exposure, then writes severity-ranked reports. Analyzes 10,000+ CloudTrail events.

A homelab simulating a small enterprise environment to practice the core security-analyst workflow: collecting telemetry, detecting suspicious activity, investigating events, and documenting remediation. Windows and Linux systems in an isolated virtual network with centralized identity and SIEM-based monitoring, running structured investigations from detection through findings. Currently building it out; write-up will follow as it comes together.