Hi, I'm John
I design and build production-ready, secure web systems — from MERN/Next.js SaaS apps to CI/CD pipelines, cloud infrastructure, and adversarial security research. I make hard problems look simple.
Expertise
Skills & Capabilities
A breadth of technical skills developed across full-stack development, cloud infrastructure, networking, and offensive/defensive security.
Full-Stack Development
Building scalable, type-safe web applications end-to-end.
Cloud & DevOps
Automating infrastructure, CI/CD pipelines, and cloud architecture.
Networking & Infrastructure
Designing and securing enterprise network infrastructure.
Cybersecurity
Offensive and defensive security across networks, endpoints, and applications.
Portfolio
Featured Projects
Real-world systems I've designed and built — covering full-stack SaaS, security tooling, DevOps automation, and infrastructure.
fullstack
SecureVault SaaS
Multi-tenant secret management platform that lets teams store, rotate, and audit environment variables and API keys with fine-grained RBAC. Secrets are encrypted at rest with AES-256 and in-transit via mutual TLS.
security
Zero-Trust API Gateway
Reverse-proxy gateway enforcing mTLS, OAuth2 token validation, per-route rate limiting, IP reputation scoring, and request/response payload inspection against the OWASP Top 10.
devops
DevSecOps CI/CD Pipeline
End-to-end pipeline that blocks deployments on SAST findings (Semgrep), dependency CVEs (Trivy), DAST scan failures (OWASP ZAP), and container image policy violations (OPA/Conftest).
security
Active Directory Attack Lab
Isolated virtualized environment simulating a real enterprise AD forest (Windows Server 2022, multiple domains, GPOs). Includes automated attack playbooks: Kerberoasting, Pass-the-Hash, DCSync, and Golden Ticket via Sliver C2.
security
SOC Detection Platform
Real-time threat detection and incident-response dashboard correlating logs from firewalls, endpoints, and cloud services using Sigma detection rules. Automated playbooks triage and escalate alerts with enriched context.
infrastructure
Cloud Infrastructure Monitor
Full-stack observability platform aggregating metrics from AWS CloudWatch, on-premise network devices (SNMP), and application traces (OpenTelemetry) into a unified dashboard with intelligent alerting.
More projects on GitHub, including open-source security tooling.
View All on GitHubOffensive & Defensive
Security Expertise
From adversary simulation and Active Directory exploitation to SOC operations and threat detection engineering.
500+
CVEs Triaged
via SOC operations
20+
AD Attack Paths
lab-validated techniques
10/10
OWASP Coverage
categories hands-on
L1 & L2
Incidents Handled
SOC analyst experience
# Unified Kill Chain — Red Team Workflow
Passive/active enumeration, OSINT, BloodHound
Payload generation, shellcode, Sliver implants
Phishing, supply chain, exposed services
CVE exploitation, Kerberoasting, PTH
Sliver C2, lateral movement, DCSync
Sigma rules, SIEM alerts, IR playbooks
# Active Directory Attack Techniques (MITRE ATT&CK)
Kerberoasting
Request TGS tickets for service accounts and crack offline
Pass-the-Hash
Reuse NTLM hashes without cracking for lateral movement
DCSync
Simulate DC replication to dump all domain hashes
Golden Ticket
Forge Kerberos tickets using the KRBTGT hash for long-term access
Network Discovery
Map internal network, identify domain controllers, admin shares
C2 over HTTPS
Maintain persistent access via encrypted C2 callbacks
OWASP Top 10 — Full Coverage
Broken Access Control
Unauthorised access to resources or actions
Cryptographic Failures
Weak or missing encryption of sensitive data
Injection
Unsanitised input reaches interpreters (SQL, LDAP, OS)
Insecure Design
Missing threat modelling and security architecture
Security Misconfiguration
Unnecessary features, default credentials, verbose errors
Vulnerable Components
Outdated or unpatched libraries and frameworks
Auth Failures
Weak auth, credential stuffing, broken session management
Software Integrity Failures
Unsigned updates, insecure CI/CD, unverified serialisation
Logging & Monitoring Failures
Insufficient logging lets breaches go undetected
SSRF
Server-side requests to internal/unintended targets
C2 Framework Experience — Sliver
Hands-on experience deploying and operating the Sliver C2 frameworkin isolated lab environments. Skills include implant generation (HTTPS/mTLS beacons), operator management, post-exploitation modules (BOF execution, SOCKS proxying), and writing detection rules for Sliver's IOCs in Elastic SIEM. All activity is conducted in air-gapped lab environments for research and detection development.
Architecture
System Design & Scalability
How I think about building systems that handle millions of requests, recover from failures, and stay secure under load.
Production Web Architecture — AWS Reference
Client
Browser / Mobile
CDN
CloudFront
WAF / ALB
AWS WAF + ALB
App Servers
ECS Fargate × N
Redis Cache
ElastiCache
Primary DB
RDS PostgreSQL
Read Replica
RDS Read Replica
Object Store
S3 + Glacier
Horizontal Scaling
Stateless application servers behind an ALB, auto-scaled with AWS ECS/EKS based on CPU and request latency metrics.
Multi-Layer Caching
CDN (CloudFront) → Redis (session + query cache) → DB query cache. Cache-aside pattern for dynamic data with TTL-based invalidation.
Data Architecture
Primary RDS (PostgreSQL) with read replicas for analytics. MongoDB for document workloads. S3 for object storage with lifecycle policies.
Security by Design
WAF at the edge, mTLS between services, secrets in AWS Secrets Manager, VPC with private subnets, zero-trust network policies.
Event-Driven Architecture
Kafka/SQS for async processing of heavy tasks. Dead-letter queues for error resilience. Saga pattern for distributed transactions.
Observability
OpenTelemetry for distributed tracing, Prometheus + Grafana for metrics, structured JSON logging to Elastic, alerting via PagerDuty.
Writing
Security & Engineering Blog
Practical write-ups on red teaming, DevSecOps, web security, and system architecture — the things I learn building and breaking systems.
Kerberoasting From Both Sides: Attack Execution and Detection With Elastic SIEM
A deep dive into how Kerberoasting works under the hood, step-by-step execution against a lab AD environment, and the exact Sigma rules to detect it in production.
Shift-Left Security: Building a Zero-Compromise CI/CD Pipeline With GitHub Actions
How I wired Semgrep, Trivy, OWASP ZAP, and OPA into a single GitHub Actions workflow that blocks PRs on security findings — without slowing down the team.
OWASP Top 10 for Next.js Apps: A Practical Hardening Checklist
Working through every OWASP Top 10 category with concrete Next.js / Node.js mitigations — from injection prevention to security logging and monitoring.
Get In Touch
Let's Work Together
Have a project, security assessment, or collaboration in mind? I'm available for full-time roles, freelance engagements, and consulting.
I typically respond within 24 hours. For urgent security matters or professional enquiries, email is the fastest route.
hello@example.com
GitHub
github.com/johndoe
linkedin.com/in/johndoe
Open to full-time positions, security consulting, and freelance web development.