Open to work Security Engineer Carson, California
Build. Break. Repeat.
I build detection — the rules, the pipeline that feeds them, and the lab I attack to find out where they fail.
Open to IAM, SOC, security analyst and security engineering roles
By the numbers
Featured artifact
A security tool decides whether an internet address is dangerous by asking reputation services what they know about it. Mine asked three. The first time it saw real traffic from my own machines, it called eleven ordinary connections attacks — nine of them to Cloudflare, the service that sits in front of a large share of the web. That is roughly 82% wrong, on real traffic, within minutes, from code whose tests had been passing the entire time.
It was never one bug. Each fix revealed the next, and only the fourth explained why the first three had not been enough on their own.
Whatever the most alarmed service said became the answer. One jumpy source could condemn an address by itself, with the other two disagreeing.
score = max(scores) A single community report was enough to push an address over the line, however thin that report was. Popular services get reported constantly, simply because so much traffic passes through them.
OTX scored presence, not weight VirusTotal asks around ninety antivirus vendors. A genuinely malicious address is typically flagged by five of them — which as a percentage is 5%, and 5% reads as clean. The best source in the set could almost never say “dangerous”.
VirusTotal scored as a ratio Two of the three services are built from public reports submitted by the internet at large, so they tend to agree with each other. Counting them as two separate opinions let them outvote the only service doing its own analysis.
Consensus counted votes, not independence Four corrections, one per fault: a known-safe list for the big content networks, scoring on how many vendors flagged an address rather than what fraction did, a rule that two services must agree before anything is called dangerous, and a tie-breaker for when the one independent service has looked hard and found nothing.
I declared it fixed after one clean run. The clean run turned out to be a cached result rather than a working fix, and the false alarms came back — so I went back through all 25 addresses the rule had ever flagged and scored them again.
24 of 25 false alarms gone, and the one real threat still caught. The fix removed the noise without removing the signal, which is the only outcome that counts.
def _vt_clean_veto(details: dict) -> bool:
"""True when VirusTotal analysed this indicator broadly and found nothing.
AbuseIPDB and OTX are both community-REPORT feeds and therefore correlated:
both penalise shared cloud/CDN addresses for the sites hosted behind them.
Counting them as two independent votes let them outvote VirusTotal — observed
live, where a Google Cloud load-balancer address scored abuseipdb=62 /
otx=60 / virustotal=0-of-91 and was alerted as critical C2. A broad,
unanimous VT "clean" is the strongest signal available here, so it caps the
verdict at suspicious rather than malicious.
"""
threshold = int(settings.TI_VT_CLEAN_VETO_ENGINES or 0)
if threshold <= 0:
return False
total, mal = details.get("vt_total"), details.get("vt_malicious")
if total is None or mal is None:
return False # VT not queried (no key) or errored — no veto
return int(total) >= threshold and int(mal) == 0Full source, including the agreement rule: soc-lab-showcase / threat_intel_scoring.py
Case studies
Event March – April 2026
A hacking competition for 100 players, built from scratch and shipped in 17 days
167 challenges, over 100 servers, 30 competing teams, 931 correct answers, one rented machine, one three-and-a-half hour window and no second chance.
Lab / personal 2025 – present
I built a security monitoring system, then attacked it to find out what it missed
Pointing real machines at it exposed roughly 82% false alarms in my own scoring code. Fixing it took four separate corrections and re-checking every address the system had ever flagged.
Other work
Fifteen walkthroughs of a themed hacking competition, covering web attacks, cloud misconfiguration on AWS and Azure, forensics, privilege escalation and two rounds of AI prompt injection. Each one explains the underlying weakness and the dead ends I hit — and then ends with the detection rule that would have caught it. Most writeups stop at the answer. Stopping there always felt like doing half the job.
In March 2026 a widely used piece of open-source software was tampered with at the source, so anyone installing it also installed a remote access tool. I published scanners for Windows, macOS and Linux within a day — they check whether a machine has a compromised version, look for the traces the malware leaves behind, and check for an active connection out to the attacker. It also documents the one configuration change that would have closed the window entirely.
A fill-in-the-blanks intake document and build specification for anyone in security building their own site. It came out of taking apart real portfolios and noting what makes a hiring manager keep reading. The site you are on was built to this spec, including the parts that were uncomfortable to follow.
The companion site to a faculty session I delivered on using AI assistants for real teaching work — what each one is actually good at, where they fail, and when not to reach for one at all. Written for instructors, not engineers.
Not public
CSUDH Office of the Vice Provost
Turns the university class schedule into an hour-by-hour picture of how busy each building will be. Built first as a standalone Python application, then rebuilt as a script running inside the office’s own spreadsheet once it was clear that a new application handling student data would need a security review outlasting my appointment. Still in use. The data is confidential, so nothing from it is shown.
Cryptographic algorithms implemented from scratch, a LAMP server build, a Docker and Jenkins build pipeline, an AWS deployment project, and Red Hat administration practice — from the graduate programme and the year of technical training before it.
Blog
Most writeups stop at the answer. Stopping there has always felt like doing half the job — the interesting question is not how the attack worked, it is what would have noticed it.
Forensics
Someone left a backdoor on a Windows machine without saving a single file. It hid inside a database Windows keeps for its own housekeeping — and ran itself once an hour, as the most privileged account on the system.
Network forensics
A guest laptop was quietly sending everything typed on it to an attacker — one character per web request, hidden in the part of a request nobody inspects.
AI security
An AI assistant guarded an internal code. It decided whether you were allowed to have it by asking your name — and then believing the answer.
Experience
Elected vice president in January 2025, then president that August.
A 120-member student community running four flagship events a year, including the university’s annual hacking competition.
The office was losing the analytics tool it used to see how busy each campus building would be, and was evaluating a paid replacement.
Three consecutive full-time technical programmes over eleven months, moving from systems administration into offensive security.
Front-line support for an enterprise SAP system during a platform migration. Deciding who is allowed to do what, and fixing it when the answer is wrong.
Supplemental instruction leader and then mentor, supporting statistics and Java students in lecture and running structured revision sessions. Teaching assistant across large mathematics courses, where I delivered a faculty session comparing AI assistants on real teaching tasks. Technical assistant at the University Theatre. President of the Indian Student Organization, running cultural festivals across the academic year.
Skills
Education
Aug 2024 – May 2026
California State University, Dominguez Hills Carson, CA
3.9 GPA Nine courses, 254 graded pieces of work, 94.2% average.
Graduate Project 100%
My capstone was SOC 2.0 — the security monitoring system on this site. It has kept growing since.
Advanced Hacking Prevention 97.2%
Every attack lab shipped with a matching defence lab. Wrote scanners and packet tools from scratch rather than running someone else’s.
CyberOps and Cloud DevSecOps 94.7%
Build pipelines, log analysis, intrusion detection and secure cloud architecture. Final project was a banking system on AWS aligned to payment-card and financial regulations.
Aug 2017 – May 2021
L.J. Institute of Engineering & Technology, Gujarat Technological University Ahmedabad, India
Certifications
CompTIA
Earned June 2025 Valid to June 2028
ISO 17024 accredited · DoD 8140 approved
VerifyRed Hat
Earned January 2024 Valid to January 2027
Performance-based exam — no multiple choice
VerifyCoursera
Earned July 2023 No expiry
Foundations — completed before starting the master’s
VerifyIn progress TryHackMe AI Security — learning path, not a certification, expected August 2026.
Also: ethical hacking and cryptography coursework (Grras Solutions), and the Tata Group cybersecurity analyst job simulation.
TryHackMe Top 4% · 119 rooms · 18 badges as of 8 August 2026
About
I started in access administration at Tata Consultancy Services, setting up SAP users and chasing down the reasons people could not get into the systems they needed. It was unglamorous work and it turned out to be the right foundation — deciding who is allowed to do what is where a great deal of security actually lives. I finished an M.S. in Cybersecurity at CSU Dominguez Hills in May 2026 and spent that time building the things I wanted to be able to point at.
What I am best at is detection: writing the rules that recognise an attack, and building the plumbing that gets the evidence to them. I built a security monitoring system, wrote 32 rules for it, and then pointed real machines at it — an Ubuntu machine, a Windows machine, and a Kali machine actually attacking them both. Two multi-step attacks were caught. Most of what I learned came from what broke afterwards.
I trust measurements over assumptions, which is mostly a habit of distrusting my own work. My scoring code looked fine until real traffic showed it was calling Cloudflare an attacker — around 82% false alarms. I fixed it, declared victory off one clean run, watched the false alarms come back, and only then went through all 25 addresses it had ever flagged and scored them again. That is the version I trust. The same habit turned up a limit that could be bypassed by asking a different server, and an application that could not see who any of its visitors actually were.
I led the CSUDH Cybersecurity Club as vice president and then president, recruited a six-person officer team, and ran a 120-member community. For our annual competition I designed and built the entire platform — 167 challenges, over a hundred servers, three difficulty tracks and a five-act story, on one rented machine, in 17 days. Sixty-two people competed on it for three and a half hours. Before that I spent two years as a supplemental instruction leader and teaching assistant, which is where I learned that explaining something clearly is a separate skill from knowing it.
My lab runs often enough to keep breaking in interesting ways. I am in the top 4% on TryHackMe with 119 rooms completed, and I write up the ones worth writing up — including the defensive rule, because stopping at the answer has always felt like doing half the job. Right now I am working through AI security, partly out of self-interest: I built five escalating prompt-injection challenges for the competition and I would like to be better at both sides of that.
I have unreasonably strong opinions about cooking. Every recipe gets my own edit, and you have not had a proper sandwich until you have had one of mine. I like people, which turns out to matter more in this work than it sounds like it should.
Contact
I am looking for IAM, SOC, security analyst or security engineering roles — the kind where I own something end to end rather than watch a queue. I want to work somewhere the goal is bigger than the quarter, on a product that leaves people better off. I bring production access-administration experience, a detection setup I built and tuned against real attacks, and a habit of finding my own mistakes before someone else does.