Security engineering · synthetic lab
Home SOC Lab
Active Directory hardening, CIS-aligned Group Policy, advanced audit policy, Sigma detections, Wazuh rules, incident triage, and compliance mapping.
Open evidence
See the work, the reasoning, and the controls.
These are not decorative dashboard promises. They are public GitHub repositories with runnable code, real Markdown, tests, incident writeups, and the standards each design decision is meant to satisfy.
How to read the proof
Every demo follows the same evidence chain.
Start with the problem statement, inspect the implementation, read the philosophy behind the design, then check the standards or operational practice it references. Synthetic data is labeled. Private client systems are never presented as public proof.
01
Problem
What was broken, risky, slow, or hard to audit?
02
Implementation
Where are the code, manifests, tests, and runnable instructions?
03
Reasoning
Why this architecture, boundary, control, or tradeoff?
Specific proof repositories
Open the evidence behind each capability.
Security product · runnable app
CloudRiskIQ
A full-stack security findings demo that normalizes AWS, Azure, endpoint, and GitHub findings, applies explainable risk scoring, maps controls, and exports evidence.
Reliability engineering · local cluster
Self-Healing Kubernetes Pipeline
A local kind reconstruction of a scheduling stampede, with good and broken manifests, probes, resource controls, PDB, HPA, observability, CI, and recovery runbook.
Revenue operations · approval-aware
Lead Operations Control Plane
Lead intake, explainable prioritization, follow-up drafting, idempotent ingestion, and an explicit owner approval before outbound action.
Applied AI · local-first
Agentic Workflow Control Plane
Checkpointed planning, artifact creation, bounded execution, recovery states, and a fail-closed stop before external action. The repository also documents the MCP host boundary: namespaced tools, allowlists, schema filtering, and policy-aware routing.
Legal technology · synthetic matter
Private Legal AI Workbench
Local source-grounded retrieval with matter boundaries, citations, explicit no-answer behavior, and a clear not-legal-advice boundary.
Standards and best practices
Design decisions should be inspectable.
The repositories use standards as reasoning tools, not as decorative badges. The linked docs show exactly where each standard enters the design.
- NIST Cybersecurity Framework 2.0 ↗ for executive-level risk and control organization.
- CIS Controls v8 ↗ and CIS Benchmarks for concrete hardening.
- Sigma ↗ for portable, version-controlled detection logic.
- MITRE ATT&CK ↗ for adversary behavior and technique context.
- Kubernetes probe guidance ↗ for separating liveness from readiness.
- Kubernetes disruption guidance ↗ for availability floors and PDB behavior.
Evidence boundary
Public code is not client access.
These repositories use synthetic data, local labs, or sanitized reconstructions. They demonstrate how we think and build. Credentials, private dashboards, customer records, and production access stay out of public proof.
Inspect the source ↗What is and is not claimed
Receipts over theater.
A public repository can prove that code, documentation, tests, and reasoning exist. It does not by itself prove a production deployment, a client outcome, or compliance certification. Those claims require separate evidence and a scoped engagement.
Proven here
Source code, Markdown rationale, local execution paths, tests, manifests, and standards references.
Clearly labeled
Synthetic data, local clusters, reconstructed incidents, drafts, and known implementation limits.
Scoped privately
Production deployment, client-specific controls, confidential evidence, and measured outcomes.
Home and local-first systems
Patterns we use at home before adapting them for clients.
These repositories are sanitized public templates. They show the same operating discipline in a household context while keeping real family data, devices, addresses, and infrastructure private.
Home Server Operations ↗
Service health, backup freshness, recovery procedures, local model availability, and supervision patterns.
Inspect the health-check code ↗Private Family Assistant ↗
Household questions, reminders, drafting, and approval before purchases, messages, deletion, or security changes.
Inspect the approval policy ↗Home Knowledge Vault ↗
Markdown-first manuals, warranties, maintenance procedures, provenance, sensitivity labels, and review dates. Optional screenshot-aware retrieval preserves diagrams and scanned records. Source hashes flag stale answers for review instead of silently publishing changed guidance; see PixelRAG ↗ for the visual retrieval reference.
Read the record template ↗Enablement and creative systems
Capability includes adoption, not just software.
AI Adoption Operating System ↗
Role-based training, safe-use patterns, workflow redesign, verification, and manager feedback loops. The reference path includes Microsoft AI for Beginners ↗, paired with local policy, approval controls, and a bounded task-decomposition lesson ↗.
Read the training module ↗Creative Production Workbench ↗
Creative briefs, constraints, review state, accessibility metadata, provenance, and approval before publication.
Inspect the approval code ↗Contract scale
Focused implementation for small businesses, defined workstreams for mid-market teams, and scoped architecture or engineering support for larger organizations.
Want to inspect one of these with us?
Choose a repository, bring the business problem, and we can map the smallest defensible next build.