I'm a SOC & Security Engineer based in Abu Dhabi, building and operating enterprise and government SOC environments on the Microsoft security stack — Sentinel, Defender XDR and Entra ID — across Azure and hybrid estates.
I like the engineering half of security: onboarding log sources properly, writing KQL that holds up in production, and tuning noise out of the pipeline so analysts spend their time on the alerts that matter. A background in penetration testing keeps the attacker's view in every detection I write.
| ⏱️ 4 days | Critical infrastructure onboarded against a 10-day scope |
| 💸 30–40% | Monthly log-ingestion reduction across client tenants — detection coverage intact |
| ✅ Zero | Post-deployment rework on a full government SOC build |
- 🛡️ Engineering SOCs and detection content at Ansen Technologies (multi-client, SLA-driven)
- 📚 Studying for SC-500 (Azure Security Engineer) and SC-401 (Information Security Administrator)
- 🧪 Building TFII, CertPrep and Kestrel in the open
| Project | What it is | Stack |
|---|---|---|
| TFII | Self-hosted threat-intel workspace that pulls public feeds and CVE data into one place and shows its reasoning — corroborated confidence, honest geolocation, bulk IOC triage, STIX 2.1 / TAXII 2.1, CISA KEV + EPSS. | Python FastAPI React PostgreSQL Docker |
| CertPrep | Exam prep for SC-200 / SC-401 / SC-500 with a simulated Defender XDR + Sentinel + Azure lab — a real KQL engine and a full intrusion hidden in the telemetry. 534 tests. | Next.js Tailwind Prisma Postgres |
| Sentinel Workbooks | Weekly SOC reporting workbook: incident trend, ingestion volume & cost, top log sources, MITRE tactic coverage, blocked IPs, failed-login leaders. | Sentinel KQL Azure Workbooks |
| Kestrel | Tasker-grade automation & Modes for any Android phone. Turns Shizuku's perishable shell authority into permanent grants that survive reboots. | Kotlin Compose Shizuku |
| GetFit | 100% offline, no-account Android workout tracker with a 1,300+ exercise library. | Kotlin Jetpack Compose Room |
| Neoteric OS | Minimal custom Android ROM focused on UI/UX and performance — AOSP-level device bring-up, vendor/hardware layers and framework forks. | AOSP C++ SELinux |
SIEM & detection
Endpoint, identity & cloud
Threat intel, IR & vulnerability management
Offensive security
Build
| Certification | Status |
|---|---|
| SC-200 — Microsoft Security Operations Analyst Associate |  |
| CompTIA Security+ (SY0-701) | |
| SC-900 — Microsoft Security, Compliance and Identity Fundamentals | |
| CPT — Certified Penetration Tester (Ehackify) | |
| SC-500 — Microsoft Azure Security Engineer |  |
| SC-401 — Microsoft Information Security Administrator Associate | |
Six habits that show up in my day job and my side projects alike — each with the receipts:
Show your reasoning · Fail loudly, never silently · Tune for signal, not volume · Test the claims · Write it down so others can run it · Private by default
▶ See them in practice on the portfolio
Want to compare notes on Sentinel, KQL or detection engineering? Say hello from the portfolio.