Security-minded ops leader turning AI into a practical tool — not a buzzword.

Wazuh alerting for SSH brute force on Windows

Built a small home soc layout with Wazuh, Windows, and Kali to turn noisy SSH failures into a clear alert for a tier one analyst.

• Custom AJT rule wraps the base Wazuh content for Windows event 4625.
• Threat hunting view shows the full burst of attempts against a single account.

Outcome: End to end path from attack traffic to analyst ready alert with clear story and screenshots.

Private RAG stack for soc notes

Cloud LLMs introduced cost, latency, and data concerns. I built a local RAG stack for playbooks and tickets instead.

• Docker Compose stack with Ollama, OpenWebUI, and Qdrant on Ubuntu.
• Vector search across private procedures and past triage notes.

Outcome: Fast local lookups, no customer data leaves the host, smoother triage.

Next: Add access control and separate namespaces per playbook set.

CISSP inspired mini risk assessment

A small team lacked a clear view of which assets and threats mattered most, so I led a focused risk session.

• Mapped assets, threats, likelihood, and impact into a simple matrix.
• Delivered a short executive brief with concrete next steps and owners.

Outcome: Leadership gained a reusable template and a clear starting point for a living risk register.

Next: Formalize a register and schedule regular reviews.