I work at the intersection of security engineering and data science, building forensic automation, predictive models, then shipping them. Eight years of security domain knowledge feeding ML feature sets nobody else thinks to engineer. By day, a senior security engineer building Python automation and applied LLM workflows over high-volume operational data. Outside of work, I ship end-to-end data science and security projects with live deployments, reproducible pipelines, and test suites.
Currently exploring: regime-aware recalibration, context-aware security scanning, and LLM grounding for structured extraction.
|
Detection · Forensics · IR Python automation · KQL · forensic analysis · Panther detection-as-code · CVE triage |
R² 0.615 PRA holdout Calibrated regressors · time-aware validation · regime-aware bundles · n_test 43K |
4 pluggable backends OpenAI · Anthropic · Hugging Face · local llama.cpp · IOC extraction & structured rationale |
🛡️ AlertSage: SOC Triage ConsolePython · scikit-learn · sentence-transformers · Streamlit · LLMs · SQLite Free-text security incident in, MITRE ATT&CK triage card out. A TF-IDF + sentence-transformer hybrid handles the fast first pass. An LLM (OpenAI, Anthropic, Hugging Face, or local llama.cpp) commits to the verdict and writes the rationale, with hallucination guardrails that downgrade to deterministic output when the model diverges from source. 8-class taxonomy · 13 MITRE ATT&CK tactics · SQLite case management · batch up to 500 rows
|
🏀 Hooplytics: NBA Analytics PlatformPython · scikit-learn · pandas · Streamlit · Sports APIs End-to-end analytics platform for NBA player outcomes. 60+ leakage-safe features across rolling windows, role/matchup context, and rest effects. 8 calibrated regressors on a 215K-row chronological holdout. Regime-aware playoff bundle swap lifts PRA R² from 0.615 → 0.695 without retraining. PRA R² 0.615 · n_train 172K · n_test 43K · automated promotion gate
|
|
Python · Typer CLI · SARIF 2.1.0 · Homebrew tap Context-aware macOS security scanner. Identifies unsigned apps, Gatekeeper violations, and suspicious persistence mechanisms with smart vendor recognition. Entitlements auditing, browser extension analysis, baseline/diff mode, and SARIF output for GitHub Advanced Security. 59 passing tests · Homebrew tap · Privacy-first, read-only
|
📚 KoNotesPython · Streamlit · LLMs · NLP Local-first reading intelligence platform. Converts Kobo and Kindle annotations into structured, queryable insight with semantic theme clustering, similarity search, LLM chat integration, and rule-based recommendations. 571 tests · 20+ modules · 7-subcommand CLI
|
| ML / Modeling | scikit-learn, classification, regression, calibration, time-aware validation, residual diagnostics, threshold tuning |
| Security domain | detection-as-code (Panther), forensic automation, KQL, Snowflake SQL, macOS trust assessment |
| Applied AI | LLM IOC extraction, incident classification, hallucination guardrails, multi-provider routing, AI-assisted case reporting |
| Python data stack | Python, SQL, pandas, NumPy, statistical reasoning, EDA, reproducible Jupyter workflows |
| Delivery | Streamlit dashboards, Typer CLIs, SARIF 2.1.0, JSON pipelines, joblib model artifacts, REST APIs |