Full Apex backend (trigger + handlers, batch, scheduler) for iDEM Connect: 3 business rules implemented, 23 tests at 100% pass rate, 90% org-wide coverage, structured technical documentation with a requirements-to-tests traceability matrix.
Complete design of a multi-carrier Salesforce delivery-tracking backend for Le Temps des Papillons: real-time architecture (Apex REST webhook + Queueable + LWC) for 2 carriers, Talend/Bulk API v2 batch flow for the 3rd, zone-based security model and import strategy for 2.1M accounts.
Deployment strategy and documentation: environments, release process, API tests, and production rollout with traceability.
Network perimeter security lab: pfSense 2.6 VM as LAN gateway, firewall rules blocking server internet access, Squid + SquidGuard transparent proxy with URL filtering, LightSquid reporting and internal CA for HTTPS inspection.
Captured and analyzed network traffic on an isolated lab to demonstrate why unencrypted protocols (HTTP, FTP) expose data in plaintext — including a custom Python sniffer built with Scapy.
Hands-on study of password storage (hashing, salting, stretching) with John the Ripper and Hashcat, including a measured MD5 vs bcrypt benchmark and full troubleshooting of a GPU-less Hashcat environment.
Deployed a Cowrie honeypot on an isolated VMware lab to capture, log, and analyze an SSH brute-force attack — including a full rebuild of the attacker machine after a real incident.
Real-time local network scanner: FastAPI backend with WebSocket streaming, concurrent port scanning, service & risk detection, and a React/Vite frontend.
Python CLI tool that runs modular vulnerability assessments (network, system, web) and generates self-contained HTML reports with CVSS v3.1 base scores, risk-prioritized findings, and JSON export for SIEM/ticketing integration.
Ticketing workflow for security incidents enforcing a strict lifecycle via a state machine, a per-severity SLA clock, and a timestamped audit trail of every status change, comment, and assignment.
Vulnerability triage dashboard syncing real CVE data from the public NVD API, ranked by a transparent priority-scoring engine that cross-references CVSS severity with CISA's Known Exploited Vulnerabilities (KEV) catalog.
Rule-based detection engine for authentication logs, surfacing brute-force attempts, impossible-travel logins, credential-stuffing bursts, and off-hours access — each rule a pure, unit-tested function with zero I/O.
A set of structured playbooks designed for SOC teams and IT admins covering the 6 most common cybersecurity incidents. Each playbook follows the full IR lifecycle: Detection → Triage → Containment → Eradication → Recovery → Lessons Learned.
Full-stack security monitoring dashboard built with FastAPI and React/TypeScript. Streams security events in real time via WebSocket, classifies alerts by severity, and tracks MTTR — now with SQLite persistence, API-key-protected ingestion, and a Pytest test suite.
Ground-up rebuild of an earlier risk-matrix prototype: a vanilla-JS risk register with a live 5×5 Likelihood × Impact heat map, persisted client-side via localStorage, plus a tested Python CLI for bulk import and HTML report generation.
Unified risk register combining three sources under one Likelihood × Impact scoring engine: STRIDE threat modeling per application component, vendor/third-party risk scored by a transparent heuristic, and an incident log that suggests a probability recalibration over a rolling 12-month window — never applied without an explicit click.
