Bilingual cybersecurity and infrastructure professional with enterprise experience in identity, Citrix remote access, Windows environments, security operations, vulnerability remediation and cloud-security engineering.
The NorthStar portfolio moves from secure foundations to identity, detection, delivery controls and architecture. Each project links to its public evidence and documentation.
Designed segmented Azure networking, implemented subnet-level NSG controls, analysed effective rules and documented repeatable Bicep and Azure CLI deployment planning.
View project ↗Extended an implemented Entra identity lab into a hybrid AD/Entra architecture for a fictional 5,500-person enterprise, covering JML/IGA, federation, privileged access and workload identities. Includes ten design decisions, a threat model and sixteen acceptance scenarios; enterprise deployment tests remain pending.
View IAM architecture ↗Tuned WAF detection from 30 days of telemetry, remediated 455 legacy incidents, automated approval workflows for Medium and High incidents, and deployed a least-privilege managed-identity Logic App response playbook with ten live configuration checks.
View verified project ↗Built a Terraform-managed Azure landing zone with segmented networking, Application Gateway WAF, App Service, Key Vault, managed identities and Sentinel detection.
View project ↗Created a secure infrastructure-delivery pipeline with Terraform quality checks, Checkov scanning, policy-as-code, protected pull requests and passwordless OIDC live planning.
View project ↗Completed a unified architecture grounded in five validated NorthStar projects, with an eight-path threat model, security controls mapping, governance responsibilities, recovery planning and an implementation roadmap.
View completed architecture ↗Designed on-premises-to-Azure connectivity, hub/spoke routing, hybrid DNS, AD/Entra dependencies, private access, and migration/recovery. Includes eight design decisions and fourteen acceptance tests; deployment validation remains pending.
View hybrid architecture ↗Built an isolated Juice Shop/ZAP pipeline in GitHub Actions. Validated CSP/CORS gateway controls with baseline and retest scans covering 95 URLs each, Chromium compatibility checks, and a selected-control regression gate. Dependency and inline-style findings remain documented.
View verified security case study ↗Implemented a governed AWS multi-account foundation with Organizations, Control Tower, dedicated Security and Log Archive accounts, centralized AWS Config and organization-wide CloudTrail. Validated inherited workload configuration recording, S3 public-write prevention, log-file validation, Terraform validation and CI.
View AWS implementation ↗Built a Terraform-managed AKS security foundation with Azure RBAC, restricted API access, workload identity, Key Vault CSI secrets, Cilium network policy and Azure Policy. Validated secret retrieval, privileged-container denial, DNS access and blocked external egress.
View implementation and validation evidence ↗These implementations extend the NorthStar Security Operations project with repeatable validation, evidence-driven detection tuning and approval-gated response automation.
Built a policy-driven PowerShell validator that performs ten live Azure and Sentinel configuration checks, detects drift, produces sanitized JSON evidence and runs through GitHub Actions using passwordless OIDC.
View verified implementation ↗Analyzed 30 days of WAF telemetry, replaced a noisy match-all detection with a high-confidence rule, remediated 455 legacy incidents and deployed approval-gated automation with a least-privilege managed-identity Logic App.
View operating model and evidence ↗The portfolio distinguishes lab-validated work from target-state architecture. That boundary is deliberate: credible evidence beats inflated claims.
Identity, access and network choices start by reducing unnecessary pathways and excessive permissions.
Controls are paired with telemetry, detection logic, investigation evidence and repeatable incident records.
Infrastructure-as-code, policy enforcement and documentation reduce drift and make technical handoff stronger.
My background includes Citrix remote access, Active Directory, VPN, Windows infrastructure, virtual desktop platforms, IAM/RBAC, security operations and incident troubleshooting. NorthStar shows how that enterprise foundation transfers into Azure security work.