/Projects
Application Security Testing on EKS
Trivy, OWASP ZAP, OpenRASP, and Amazon Inspector layered on an EKS pipeline, verified by a live SQL injection blocked twice: once by ZAP at scan time and once inside the running JVM.
AWS · EKS · Trivy · OWASP ZAP · OpenRASP · Amazon Inspector · GitHub Actions · TerraformSoftware Supply Chain Security on AWS
A GitHub Actions pipeline that signs a container image keylessly, attaches SLSA provenance, and refuses to call it deployable until both verify against the exact repo that built it.
AWS · ECR · Inspector · Cosign · Sigstore · SLSA · SBOM · GitHub ActionsUnified Threat Detection on AWS
Security Hub, GuardDuty, and a Step Functions pipeline that isolates a compromised EC2 instance within seconds of a HIGH finding, no human required.
AWS · Security Hub · GuardDuty · Step Functions · EventBridge · Lambda · TerraformRuntime Security on EKS
Tetragon eBPF enforcement, Falco detection, and GuardDuty are stacked on EKS. One layer kills processes in-kernel, one builds a queryable alert history, and one catches what the other two miss.
EKS · Tetragon · eBPF · Falco · GuardDuty · Kubernetes · IRSAAWS Data Perimeter
A three-layer data perimeter built from SCPs, RCPs, and VPC endpoint policies, validated by denying a second AWS account with valid credentials and explicit IAM permissions.
AWS Organizations · SCP · RCP · VPC Endpoints · S3 · KMS · CloudTrailAWS Automated Vulnerability Remediation System
Event-driven patching pipeline that turns AWS Inspector findings into applied fixes, with per-instance locking, pre-patch health checks, and automatic snapshots so nothing gets touched without consent.
AWS Inspector · AWS SSM · AWS Lambda · EventBridge · DynamoDB · Vulnerability ManagementPolicyGuard
IaC misconfiguration scanner for AWS and Azure Terraform and OpenTofu, with Rego policies that measure precision 1.00 / recall 0.95 on a committed benchmark, plus a hosted GUI and CI-ready CLI.
Go · Open Policy Agent · HCL · GitHub ActionsCredScan
Hardcoded-secret scanner for source code, Infrastructure-as-Code, CI/CD pipelines, Docker, git history, and web endpoints, with confidence-scored detection and opt-in live verification of what it finds.
Python · FastAPI · Pre-commit hook · Git history · SARIF · DockerAWS Secrets Management Solution
Terraform module that splits secrets between Secrets Manager and Parameter Store by whether they need rotation, with Lambda-driven rotation and CloudTrail-based alerting on top.
AWS Secrets Manager · AWS Parameter Store · Terraform · Lambda · KMS · CloudWatch · EventBridgeChaos Engineering on AWS EKS
Chaos Mesh on EKS, running namespace-scoped pod-kill, latency, and network-partition experiments against a three-tier app on Spot instances, with RBAC pinning every experiment inside its sandbox.
AWS EKS · Chaos Mesh · Kubernetes · Terraform · containerd · CloudWatch · Helm · RBACAWS GENAI for Security Remediation - IAM
A Bedrock-hosted Claude 3.7 pipeline that classifies IAM findings from Security Hub and GuardDuty, and drafts the least-privilege CloudFormation fix for a human to review before it applies.
AWS Bedrock · AWS SageMaker AI · AWS Security Hub · AWS Guard Duty · AWS IAM · AWS CloudFormationAWS WAF Security Implementation with OWASP Juice Shop
OWASP Juice Shop behind AWS WAF, taken from a 30% attack-suite block rate to 100% by fixing a managed-rule override bug, with Kinesis-to-Athena log analytics and a sub-30-second emergency block script.
AWS WAF · ECS Fargate · Terraform · OWASP Juice Shop · Athena · CloudWatch · Kinesis · GitHub Actions · Python · CI/CDAWS DLP Implementation
Macie findings routed through EventBridge and Lambda to auto-contain common S3 exposure patterns, with SNS escalating anything that needs a human before the next audit finds it.
AWS Macie · AWS S3 · AWS EventBridge · AWS SNS · AWS LambdaKubeScan - Multi-Tool Container Security Scanner
A Python orchestrator that runs Trivy, Grype, and Snyk against one image, deduplicates their findings into a single report, gates ECR pushes on severity, and re-scans running EKS images every six hours.
Trivy · Grype · Snyk · Python · AWS ECR · EKS · Kubernetes · DevSecOps · Container Security · Shell ScriptingContainer Security Attack Simulation with Trend Micro Vision One Container Security
A rebuildable Kubernetes lab that replays real container attack techniques against Trend Vision One, with Trend Micro Artifact Scanner gating image vulnerabilities in CI before deploy.
Kubernetes · Container Security · GitHub Actions · Trend Vision One · Trend Micro Artifact Scanner · Shell ScriptingECS Deployment via GitLab CI
A Spring Boot app on ECS where Trivy and SonarQube gate the GitLab CI pipeline before anything promotes, and secrets are pulled from Secrets Manager at runtime instead of baked into images.
AWS Secret Manager · AWS ECS · Docker · Terraform · GitLab CI · Trivy · SonarQube · RDS - MySQLAWS Cloud Native CI/CD Pipeline
An all-AWS-native delivery pipeline for a containerized streaming app, where CodePipeline only rolls out to ECS after SonarCloud and Trivy both pass on the exact image being deployed.
AWS CodeBuild · AWS CodeDeploy · AWS CodePipeline · AWS ECS · Trivy · SonarCloud · AWS ECR · Docker HubAWS Serverless Lambda Deployment via CI/CD
A Jenkins pipeline that gates Lambda deploys on Bandit and cfn-nag, then rolls out with CodeDeploy's linear traffic shift so a bad release gets caught before it reaches everyone.
Jenkins · AWS CodeDeploy · AWS Lambda · AWS CloudFormation · Bandit · cfn-nagSecure AWS Deployment with Terraform
A cross-AZ auto-scaling AWS stack in Terraform, scanned by Checkov on every pull request and deployed from GitHub Actions with zero long-lived AWS credentials via OIDC.
AWS · Terraform · GitHub Actions · Checkov · Python · OIDCArchive 2
Microservice Project
A disposable three-tier stack (Nginx, service layer, PostgreSQL) with Prometheus, Grafana, and Jaeger wired end-to-end, built to see how a system behaves rather than assume it.
Docker · Grafana · Prometheus · Jaeger · PostgreSQL · NginxAWS Security Assessment Automation
Scheduled Prowler and ScoutSuite runs cross-referenced with Trusted Advisor, each recurring finding paired with a ready-to-run remediation script instead of a re-researched fix.
AWS Lambda · AWS Trusted Advisor · GitHub Actions · Prowler · ScoutSuite