Component & Sections Demo

Showcase of components and sections with light/dark theming.

HeroSection

Your Headline Goes Here!

I build softwares that brings you loyal subscribers.

View Projects Read Blog

Badges

Default Accent Info Success Warning Error Outline

Buttons

Separators

Scroll down
Separator

Card

Surface card

Uses Starwind CSS vars mapped to our tokens.

Carousel

Hydra
Hydra
Linux
Linux
Metasploit
Metasploit
Mimikatz
Mimikatz
Nmap
Nmap
Powershell
Powershell
Python
Python
Wazuh
Wazuh
Windows
Windows
Wireshark
Wireshark
Hydra
Hydra
Linux
Linux
Metasploit
Metasploit
Mimikatz
Mimikatz
Nmap
Nmap
Powershell
Powershell
Python
Python
Wazuh
Wazuh
Windows
Windows
Wireshark
Wireshark

Timeline

Cybersecurity Engineer (Intern)

LOG(N) Pacific

Remote

Ran proactive threat hunts across endpoint and network telemetry using Microsoft Sentinel and Microsoft Defender for Endpoint, authoring KQL queries against the DeviceNetworkEvents and DeviceProcessEvents tables to isolate suspicious activity — including a living-off-the-land PowerShell port scan traced through 100+ failed internal connection attempts. Mapped process execution and network telemetry to MITRE ATT&CK techniques to support root-cause analysis, and audited and remediated Windows systems against DISA STIG controls, implementing 10+ hardening tasks across account policy, credential settings, and administrative restrictions.

Microsoft AzureMicrosoft SentinelMicrosoft Defender for EndpointKQLNessus TenableMITRE ATT&CKDISA STIGPowerShell

Skills & Tools

SOC and detection engineering SOC e Engenharia de Detecção
Microsoft SentinelDefender XDRDefender for EndpointKQLMITRE ATT&CKSysmon
Hardening and vulnerability management Hardening e Gestão de Vulnerabilidades
PowerShellDISA STIGTenable NessusAzureActive Directory
Hands-on practice · TryHackMe Prática Hands-on · TryHackMe
NmapMetasploitHydraMimikatzLinuxREMnux

Work Experience

Cybersecurity Engineer (Intern) LOG(N) Pacific
Jun 2026 — Aug 2026 · Remote
  • Ran proactive threat hunts across endpoint and network telemetry in Sentinel and Defender for Endpoint.
  • Authored KQL against DeviceNetworkEvents and DeviceProcessEvents — traced a living-off-the-land PowerShell port scan through 100+ failed internal connections.
  • Mapped process execution and network telemetry to MITRE ATT&CK to support root-cause analysis.
  • Audited and remediated Windows systems against DISA STIG controls, implementing 10+ hardening tasks across account policy, credential settings, and administrative restrictions.
Microsoft AzureMicrosoft SentinelMicrosoft Defender for EndpointKQLNessus TenableMITRE ATT&CKDISA STIGPowerShell

Studies

B.S. in Computer Science

Western Governors University — Completed July 2025

Core CS foundations: data structures, algorithms, operating systems, networking, and databases.

Data Structures & Algorithms I & IISoftware I & IIOperating SystemsDatabasesNetworkingCalculusDiscrete Mathematics I & II

M.S. in Cybersecurity & Information Assurance

Western Governors University — Paused (50% complete)

Advanced coursework in threat hunting, incident response, and detection engineering, building directly on hands-on SOC work with Microsoft Sentinel, Defender XDR, and MITRE ATT&CK.

Threat HuntingIncident ResponseDetection EngineeringRisk ManagementNetwork Defense

Projects

DFIR Case Study: Azure Control-Plane Domain Compromise

Microsoft SentinelDefender XDRKQLREMnux

Reconstructed a simulated 17-hour domain compromise across three hosts using 28 documented KQL queries against Sentinel and Defender XDR. Traced an Azure Run Command privilege-escalation bypass and an AdminSDHolder ACL backdoor, then authored and validated new detection rules — correcting a KQL tokenization defect that had hidden a second attacker session.

View Case Study → GitHub

Azure Brute-Force Threat Hunt

Microsoft Defender for EndpointKQL

Investigated an Azure VM misconfigured with a public IP exposing internal infrastructure services to the internet. Built a five-stage KQL hunt ranking attacking source IPs by failed-logon volume and cross-referencing failed against successful authentication, confirming zero unauthorized access despite sustained credential guessing.

View Threat Hunt → GitHub

Windows STIG Hardening Automation

PowerShellDISA STIGTenable Nessus

Wrote paired PowerShell remediation and rollback scripts for ten DISA STIG controls covering password history, minimum password age, and lock-screen policy, including deliberate misconfiguration scripts to verify audit tooling detects drift. Used Tenable Nessus to scan hosts before and after remediation to confirm findings closed.

View Repo → GitHub

Internal Threat Hunt: Network Slowdown Traced to LotL Port Scan

Microsoft Defender for EndpointKQLPowerShell

Traced a network performance complaint to a PowerShell port scanner run twice against two internal hosts in a self-staged MDE lab. The obvious query — ranking hosts by total failed connections — missed the responsible host entirely; attributing failures to process and scoring ports-per-host surfaced it by two orders of magnitude. Recovered the exact command line, mapped the activity to MITRE ATT&CK (T1059.001, T1046), and shipped a ports-per-host detection rule with segmentation and PowerShell-constraint recommendations.

View Write-up → GitHub

Vulnerability Management Lab: Tenable Scan-to-Remediation Cycle

Tenable NessusAzurePowerShell

Ran authenticated Tenable Nessus scans against an intentionally unhardened Windows Server VM in Azure to establish a vulnerability baseline, then prioritized findings by CVSS and business impact. Remediated six categories of exposure — missing OS updates, an over-privileged local Guest account, outdated third-party software, disabled SMB signing, missing RDP Network Level Authentication, and legacy LM/NTLMv1 authentication — verifying each fix with a post-remediation delta scan. Reduced active vulnerabilities from 24 to 4, an 83% reduction.

View Case Study → GitHub