// TECHNICAL STACK

Skills

A full-stack view of the tooling and disciplines I work across. Not a bullet-point resume — each entry represents hands-on production experience in a working SOC environment.

AI / ML
▸Multi-agent orchestration
▸LLM integration (Claude, Codex, Qwen, DeepSeek)
▸Temporal knowledge graphs
▸Prompt engineering
▸RAG pipelines
▸Model routing & cost governance
▸Embedding search (nomic-embed)
Security
▸SIEM architecture & tuning
▸SOAR automation (n8n, playbooks)
▸Threat intelligence (MISP, OTX)
▸OCSF 1.3 normalization
▸Wazuh 4/5 — SIEM, XDR, EDR
▸Endpoint telemetry — FIM, process, auth, network
▸Behavioral correlation (HVA/LVA)
▸Incident response & DFIR
Enterprise Firewall / NGFW
▸Fortinet FortiGate (NSE7 / FCSS)
▸Palo Alto Networks NGFW + Panorama
▸Check Point
▸Cisco Firepower / ASA
SD-WAN
▸Fortinet Secure SD-WAN
▸Cisco SD-WAN (Viptela)
SASE / Cloud Security
▸Fortinet FortiSASE
▸Palo Alto Prisma Access
▸Zero Trust Network Access (ZTNA)
▸SSL-VPN / IPsec VPN
WAF / Application Security
▸Fortinet FortiWeb
▸F5 BIG-IP
▸OWASP Top 10 mitigation
Secure Email Gateway
▸Fortinet FortiMail
▸Zimbra
▸Microsoft Office 365
▸SPF / DKIM / DMARC
▸Anti-phishing, BEC defense
Identity & Access
▸Active Directory / LDAP
▸RADIUS
▸SAML / OIDC / SSO
▸MFA
▸Keycloak
▸Infoblox (DDI)
Observability
▸Grafana (dashboards, alerting)
▸Prometheus (metrics scraping, remote_write)
▸Tempo (distributed tracing)
▸Vector (metrics pipeline)
▸ClickHouse (log analytics datasource)
▸Node Exporter / cAdvisor
▸OpenTelemetry
Data / Pipeline
▸Apache Kafka (KRaft)
▸ClickHouse
▸Cribl Stream
▸MinIO / S3
▸Redis
▸OCSF 1.3 schema
▸Stream processing
Infrastructure
▸Docker / Compose
▸Ansible
▸Proxmox VE
▸nginx
▸Linux (Debian/Ubuntu)
▸systemd
▸Keycloak / SSO
Development
▸Python
▸TypeScript / Node.js
▸Next.js
▸REST API design
▸HMAC authentication
▸ClickHouse SQL
▸Shell scripting

// CONTEXT

Production-built

Everything here was deployed and operated in a working, multi-service SOC environment — not sandboxed or tutorial-only.

End-to-end ownership

I don't hand off to DevOps or "the security team." I design, build, deploy, and maintain full stacks — infra to application layer.

Continuously evolving

The stack above reflects current work. I'm comfortable picking up new tooling quickly when the problem requires it.

// HOME LAB — PROXMOX CLUSTER

CPU

40 cores

4× Intel Xeon E5-4627 v3 @ 2.6 GHz

RAM

472 GB

DDR4 ECC across 4-socket NUMA topology

Storage

25 TB+

3.2 TB local LVM · 22 TB QNAP NAS (CIFS shared)

VMs

110+

Proxmox VE 8.4 · 6-node cluster

All projects are deployed and running on this infrastructure — not a cloud sandbox, not a tutorial VM. The full SIEM stack, Kafka cluster, AI agent fabric, and observability platform run here 24/7.