Skilled in deploying and managing Kubernetes infrastructure using kubeadm or independently configuring components when needed. Proficient with common Kubernetes resource types and committed to following industry best practices, such as NIST 800-53 and CIS Benchmarks, to ensure security and compliance.

Currently my coding prefernce to automate a variety of security tasks, including fuzzing API endpoints to identify vulnerabilities and ensure robustness during security testing. My experience includes interacting with services that have unique interfaces, such as gRPC, by building custom scripts to streamline testing processes. By writing tailored Python tools, I can efficiently manipulate payloads, handle edge cases, and integrate testing workflows for enhanced coverage and accuracy.

Used in conjuction with Azure to assist with automating cloud deployments while studying for AZ500. It also proves handy when performing Active Directory enumeration and exploitation during internal penetration testing engagements.

Worked with most of the major clouds such as GCP, AWS, Azure and Oracle.

I have experience containerizing applications and services using Docker, emphasizing secure and efficient deployments. My expertise includes scanning container images for vulnerabilities and implementing network policies to restrict container-to-container communication, thereby enhancing network isolation and supporting a defense-in-depth security strategy.

Main web application security testing tool. Used for manual testing scenarios and fuzz automation. If I am performing API testing, then I would use this along with Bruno to automate the fuzzing process which is an opensource IDE For Exploring and Testing APIs.

Using Ubuntu as my main operating system. I have developed a solid proficiency in bash/shell scripting, allowing me to automate tasks, streamline workflows, and manage system operations efficiently.

Experienced with git-based development. Mostly, use Github. Additionally, I have worked with GitLab, broadening my expertise in version control and collaborative development.

I have utilized both commercial scanners and open-source tools to support my efforts from the reconnaissance phase through the entire engagement. My approach adapts based on findings and the evolving scope of the assessment.

I maintain a Proxmox server at home, leveraging OpenTofu (a Terraform fork) to efficiently provision and decommission worker nodes for Kubernetes deployments. Currently, I am exploring the automation of Command and Control (C2) infrastructure deployment using CI/CD pipelines to gain hands-on experience and identify common pitfalls or security challenges associated with CI/CD workflows.

I utilize Cowrie as an SSH honeypot to intercept and log malicious activity. This allows me to analyze attacker behavior and tactics, providing daily insights into the latest threats and techniques used by adversaries.

I have some experience as a purple teamer / incident response analyst, utilizing Security Onion as a centralized platform to analyze network traffic. I try to identify Indicators of Compromise (IOCs) from hacking tools used during penetration testing exercises to simulate real-world attack scenarios. Additionally, I have deployed Graylog for centralized log ingestion, integrating logs from my pfSense firewall and other sources.