Technical execution. Evidence that holds.
27 years of hands-on SOC builds, SIEM configurations, KQL detection engineering, AI architecture, and regulatory audit production. 85 MITRE-mapped detection rules deployed. MTTD reduced 36 hrs → 18 min. Zero breaches over 4 years across all mandates.
Quantified Delivery Impact
Every engagement produces documented, auditable results. Numbers from real deployments — not estimates.
SOC & SIEM Performance
Security & Compliance
Cloud & AI Engineering
MITRE ATT&CK Coverage Map
Detection and response coverage across MITRE ATT&CK tactics. Mapped techniques inform SOC detection strategy and purple team exercise design.
85 detection rules deployed across 11 MITRE ATT&CK tactics. Figures represent technique sub-coverage within each tactic category, as measured against the full MITRE ATT&CK Enterprise matrix.
KQL Detection Engineering
Production-grade Kusto queries deployed across Microsoft Sentinel for real-time threat detection and incident response.
Brute Force Login Detection
Authentication// Brute Force Login Detection
SigninLogs
| where TimeGenerated > ago(1h)
| where ResultType !in ("0", "50125", "50140")
| summarize FailedAttempts = count(),
DistinctIPs = dcount(IPAddress)
by UserPrincipalName, bin(TimeGenerated, 5m)
| where FailedAttempts > 10
| extend RiskLevel = iff(FailedAttempts > 50,
"HIGH", "MEDIUM")
| project TimeGenerated, UserPrincipalName,
FailedAttempts, DistinctIPs, RiskLevel
Lateral Movement via Pass-the-Hash
Persistence// Lateral Movement via PTH
SecurityEvent
| where EventID == 4624
| where LogonType == 3
| where AuthenticationPackageName == "NTLM"
| where WorkstationName != ComputerName
| summarize Hops = dcount(Computer),
Targets = make_set(Computer)
by SubjectUserName, IpAddress
| where Hops > 3
| extend ThreatScore = Hops * 10
| project SubjectUserName, IpAddress,
Hops, Targets, ThreatScore
Anomalous Data Upload Detection
Exfiltration// Anomalous Data Upload
AzureNetworkAnalytics_CL
| where TimeGenerated > ago(24h)
| where FlowDirection_s == "O"
| summarize TotalBytes =
sum(BytesSentToInternet_d)
by SrcIP_s, bin(TimeGenerated, 1h)
| where TotalBytes > 100000000
| join kind=leftouter (
DeviceNetworkEvents
| where ActionType == "ConnectionSuccess"
) on $left.SrcIP_s == $right.LocalIP
| project SrcIP_s, TimeGenerated, TotalBytes
Privilege Escalation Attempt
Escalation// Privilege Escalation Detection
SecurityEvent
| where EventID in (4720, 4722, 4728, 4732)
| where SubjectUserName !in ("SYSTEM", "root")
| summarize EscalationCount = count(),
TargetAccounts = make_set(
TargetUserName)
by SubjectUserName, Computer
| where EscalationCount > 5
| extend AlertSeverity = "High"
| project SubjectUserName, Computer,
EscalationCount, TargetAccounts
SOC Lab Architecture
Blueprint for enterprise-grade SOC deployment: Azure Sentinel workspace with integrated detection, response, and automation tiers.
Log Sources (60+)
- Azure AD & Entra Sign-in Logs
- Defender for Endpoint / M365
- Network Flows, Proxies, DNS
- Syslog, CEF & Custom Connectors
- Office 365 Audit Logs
- Cisco / Juniper / Palo Alto feeds
- CyberArk & PAM audit trails
- SAP, Salesforce & SaaS sources
Detection Engineering
- 85 MITRE-mapped KQL rules
- Brute force & credential stuffing
- Lateral movement (PtH / PtT)
- C2 beacon identification
- Data exfiltration anomalies
- Privilege escalation (4720/4728)
- MTTD: 36 hrs → 18 min
- MTTR improved 73%
Response & Automation
- Logic Apps playbooks
- Auto-blocking & quarantine
- SOAR integration
- Ticket auto-creation
- Escalation workflows
- Evidence preservation
Audit & Compliance Execution
Evidence production at scale. CAF A-D scoring matrices, ISO 27001 control mapping, and NIS submissions accepted on first presentation.
CAF A-D Evidence Production
Produced IGP scoring matrices, evidence packs, control mapping documents, and gap analysis reports for all 4 CAF objectives: A (Governance), B (Protect), C (Detect), D (Respond & Recover). Delivered to NCSC-reporting regulators.
ISO 27001 → CAF Control Mapping
Cross-mapped ISO 27001 Annex A controls to CAF objectives, producing control equivalence matrices that eliminated duplicate assessment effort and reduced compliance overhead by ~40%.
NIS Regulatory Submissions
Produced end-to-end NIS submissions for Operators of Essential Services across energy and finance. All submissions accepted by sector regulator on first presentation. Zero remediation demands.
AI + Cyber Security
As the threat surface expands into AI-generated phishing, LLM exploitation, and model poisoning attacks, your security architecture must evolve. 27 years of cyber delivery meets 2026's AI threat landscape.
LLM Security & Prompt Injection Defence
Azure OpenAI (GPT-4o) secure deployment, adversarial prompt testing, jailbreak detection, output sanitisation. OWASP LLM Top 10 assessment. ISO 42001 AI management system implementation (in progress). AI model sandboxing and guardrail architecture.
AI-Driven SIEM & RAG Architecture
Azure ML anomaly detection integrated with Sentinel. RAG pipelines using Azure Document Intelligence + LangChain + Semantic Kernel processing 2.5M+ documents/year at 94–96% accuracy. 12M+ API calls/month at <200ms p95 latency.
AI Governance & Model Risk
EU AI Act Article 9 risk management. ISO 42001 AI management system. Model inventory, bias testing, and transparency documentation. Azure AI Engineer Associate certified. AI incident classification under DORA, NIS2, and EU AI Act reporting obligations.
Cloud, DevOps & Data Architecture
Full-stack cloud architecture delivery. Security controls embedded at infrastructure layer, not retrofitted. Azure Expert certified.
Azure Cloud Architecture
Hub-Spoke network topology design, AKS/Kubernetes cluster hardening, Azure Functions serverless, Logic Apps SOAR integration, and private endpoint security across multi-region deployments. €480K/year cost optimisation delivered.
DevSecOps & IaC
Terraform and ARM/Bicep for infrastructure-as-code. Azure DevOps and GitHub Actions CI/CD pipelines with integrated SAST/DAST gates. Docker, Helm, and GitOps deployment patterns. Blue-Green and canary release strategies.
Data & Backend Engineering
.NET Core 8 (C#) and Python (FastAPI/Flask/Django) backend systems. Azure Synapse Analytics, Databricks (Apache Spark, Delta Lake), Data Factory pipelines, Cosmos DB, MongoDB, and Redis for enterprise-scale data platforms.
13 Active Certifications
Certifications spanning security governance, cloud architecture, AI engineering, and network infrastructure — all active, all examined, not honorary.
CISSP
Certified Information Systems Security Professional — (ISC)². The global gold standard for senior information security practitioners.
Governance & RiskCISM
Certified Information Security Manager — ISACA. Information security governance, risk management, and program development.
Security ManagementCRISC
Certified in Risk and Information Systems Control — ISACA. Enterprise risk management, IT risk identification, and control implementation.
Risk & ControlCCSP
Certified Cloud Security Professional — (ISC)². Cloud data security, platform architecture, and compliance across multi-cloud environments.
Cloud SecurityAzure Solutions Architect Expert
AZ-305. Advanced cloud architecture, hybrid networking, identity, storage, and security across Azure enterprise platforms.
Azure ExpertAzure Security Engineer Associate
AZ-500. Azure security controls, identity protection, platform security, data and application security implementation.
Azure SecurityAzure AI Engineer Associate
AI-102. Azure Cognitive Services, Azure OpenAI, Document Intelligence, and responsible AI implementation for enterprise workloads.
AI EngineeringAzure Administrator Associate
AZ-104. Azure infrastructure administration, virtual networking, compute, storage, and identity management at enterprise scale.
Azure AdminCCSE — Checkpoint
Checkpoint Certified Security Expert. Next-generation firewall policy, VPN configuration, and advanced threat prevention on Checkpoint platforms.
Network SecurityJNCIS-FWV — Juniper
Juniper Networks Certified Specialist – Firewall/VPN. Juniper firewall and VPN configuration, policy management, and network security architecture.
Network SecurityCCNA Security
Cisco Certified Network Associate Security. Cisco firewall, IPS, VPN, and network infrastructure hardening across enterprise Cisco environments.
Network SecurityISO 27001 Lead Implementer & Lead Auditor
Dual certification: ISMS design and implementation (Lead Implementer) and third-party ISMS audit and certification (Lead Auditor). BSI certified.
ISO 27001 Lead AuditorISO 42001 — AI Management System Lead Implementer
The world's first AI management system standard. Implementing Article 9-aligned risk frameworks for AI system governance, bias testing, transparency obligations, and incident reporting under EU AI Act.
See the governance infrastructure behind the detection work
Behind every detection rule sits an audit trail. Behind every SOC operation sits a governance mandate. Behind every regulatory submission sits engineering rigour.
Skills & Competencies
27 years of hands-on delivery across technical security architecture, enterprise leadership, regulatory governance, and academic research — extracted from 231 published doctrines and 231 specialist papers.
Technical Skills
Business & Leadership Skills
Personal & Professional Attributes
A portfolio is not a list of engagements. It is a ledger of risks that never materialised again.
Every deployment here shifted the client from reactive incident response to pre-emptive regulatory control.