I design security labs and automation that turn logs into signal.

Built a vulnerable Windows 10 honeypot in Azure running DVWA, wired into Azure Network Security Groups, Log Analytics, and Microsoft Sentinel to simulate and study real attacks such as brute-force logins and SQL injection.

• Forwarded Windows Security logs into Sentinel and wrote KQL queries to detect Event ID 4625 brute-force attempts and other suspicious patterns.
• Enriched attacker IPs with geo-IP data using a Sentinel watchlist and ipv4_lookup(), then visualized activity in a custom attack map workbook.
• Captured SQL injection attempts against DVWA and correlated them with host events and lightweight IDS alerts to practice investigation workflows.

Performed a full NIST 800-30 risk assessment using HHS breach data to understand real-world healthcare security incidents and communicate risk to non-technical stakeholders.

• Analyzed breach data to identify common threat patterns, impacted assets, and control weaknesses.
• Built Excel dashboards and executive-style summaries that surface exposure, likelihood, and impact in a way leadership can act on.

Designed an end-to-end service reporting pipeline (Google Forms → Sheets → Zapier → SQL → VBA) that eliminates manual entry, standardizes fields, and strengthens audit readiness.

• Automatically ingests and normalizes inputs from forms to a structured SQL backend, reducing human data-entry errors.
• Enforces standardized data formats so reports and internal audits can rely on consistent, queryable records.
• Produces near real-time documentation and validation that security and operations teams can trust.

Wrote a C program that scans a raw memory card image, identifies JPEG signatures, and reconstructs deleted photos into separate files — similar to a basic file-carving tool.

• Iterates over raw binary data, detects JPEG headers, and reconstructs images with proper naming.
• Demonstrates understanding of low-level file structures and how forensic tools recover artifacts.