// PROJECT DEEP DIVES

Not just what I built, but why and how

Three of my labs, explained the way I would in an interview: the real problem they tackle, my approach, and the skills they put on the table.

Blue TeamSOCKQL

Threat Hunting Lab (Mini-SIEM)

The context

In a SOC, the difference between catching an intrusion and missing it comes down to knowing how to ask the logs the right questions. I wanted an environment to train that muscle —query-driven threat hunting— without deploying a full SIEM.

The challenge

Build a browser-playable mini-SIEM: a set of logs with an attack hidden in the noise, and a console where the analyst writes KQL-style queries to isolate the actor.

My approach

I designed a realistic dataset with benign events and an attack chain (initial access, lateral movement, exfiltration).
I implemented a client-side query engine that filters, groups and counts —the mental model of KQL— over those logs.
The challenge guides the user from initial triage to identifying the compromised host.

What it demonstrates

Hypothesis- and query-driven threat hunting
Detection logic (filtering, aggregation, correlation)
End-to-end understanding of an attack chain

Open the lab →

Red TeamActive Directory

BloodHound AD Simulator

The context

Almost every company runs on Active Directory, and almost all of them have hidden attack paths: a chain of misconfigured permissions leading from any user to Domain Admin. Understanding how the attacker thinks is the best way to defend it.

The challenge

Recreate the BloodHound experience —enumerate a domain and find the shortest path to full control— in a visual, interactive simulator.

My approach

I modeled a domain with users, groups, sessions and relationships (AdminTo, MemberOf, HasSession…).
The player enumerates, chains privileges and uncovers the escalation path step by step.
Each step explains the real technique behind it (Kerberoasting, ACL abuse, etc.).

What it demonstrates

Active Directory security and attack paths
Privilege escalation and lateral movement
Graph thinking (like real attackers)

Open the lab →

ArquitecturaGRC

Secure Architecture Designer

The context

Security does not start at the firewall, it starts at design. Translating business requirements (size, budget, compliance) into a defensible architecture is a senior-level skill I wanted to demonstrate tangibly.

The challenge

A tool that, from a few parameters, generates a tailored security architecture: diagram, recommended controls and a cost estimate.

My approach

I encoded decision rules mapping each requirement to concrete controls (Zero Trust, segmentation, compliance).
The output renders as a diagram and an executive summary ready to present.
Designed to speak to both engineering and leadership (C-level).

What it demonstrates

Secure architecture design and Zero Trust
Business ↔ technical controls translation
Executive-level communication (GRC)

Open the lab →