Projects
Six builds spanning fraud detection, LLM security tooling, reinforcement learning, and classic systems design — most tied to specific internship applications.
NFC Payment Simulator
An end-to-end contactless payment stack built for an Amazon SDE internship application: a card emulator, POS terminal, and payment processor with a token vault, an ML-driven fraud detection engine, and a relay-attack timing detector — all surfaced on a live React dashboard.
- Fraud engine scores transactions on velocity, amount anomalies, and geo-jump signals
- Relay-attack detector flags suspicious timing patterns between card and terminal
- Live dashboard: transaction feed, stat cards, fraud badges
SOC Home Lab — Detection & Incident Response
A virtualized security operations center built to get hands-on with the full detection-and-response loop, not just read about it: a Windows 10 endpoint and an Ubuntu-hosted Splunk Enterprise SIEM, wired up for real telemetry and real attacks.
- Deployed Sysmon and the Splunk Universal Forwarder for endpoint telemetry and log forwarding
- Simulated real-world attacks: Hydra-based brute-force logins, phishing payload execution, encoded PowerShell execution
- Validated detections via Windows Event IDs 4625 / 4688 and Sysmon process-creation events
- Triaged alerts end-to-end — correlating Sysmon process trees, source IPs, and account activity
- Mapped observed techniques to MITRE ATT&CK (T1110 Brute Force, T1059.001 PowerShell) with formal incident reports, severity ratings, and escalation decisions
Rate Limiter Service
A fast, high-signal follow-up to the NFC simulator, built specifically because rate limiting is a classic Amazon system-design interview topic — better to have built one than just be able to whiteboard it.
- Token bucket algorithm implemented from scratch
- Exposed as a real Flask API service, not just a library function
- Load-test script fires burst traffic to validate throttling behavior
GitHub AI Security Auditor
A CLI tool that scans GitHub repositories for OWASP LLM Top 10 vulnerabilities — the kind of tooling gap that shows up as LLM adoption outpaces LLM security review — built and validated against a real production-scale codebase.
- Four dedicated scanner modules: hardcoded secrets, prompt injection risk, unsafe code execution, insecure RAG pipelines
- 14-test automated pytest suite validating scanner accuracy, plus a scoring engine with generated summary reports
- Tested against the real-world LangChain repository, iterating on detection logic to cut false positives from ~1,240 to ~40 high-confidence findings — a 97% reduction
- Swapped onto resume in place of PhishGuard to better match a Palo Alto Networks JD
Co-Evolutionary Red/Blue RL
Still just a concept I keep coming back to, not a build in progress: multi-agent reinforcement learning where an attacker and a defender agent would train against each other inside a simulated vulnerable banking environment, each improving in response to the other.
- Would use a custom "VulnBank" Gymnasium environment
- PPO agents trained via Stable-Baselines3
- Flask + Plotly Dash for monitoring training and match outcomes
PhishGuard (PsyPhish)
A Chrome extension that evaluates pages in real time for phishing risk, combining a trained classifier with live threat-intel lookups.
- XGBoost / Random Forest models for page-level phishing classification
- Cross-checks against the PhishTank API for known threats
Mini-SIEM
A lightweight SIEM for log ingestion and threat detection, built to understand the detection-engineering side of security operations from the ground up.
- Python-based log ingestion pipeline
- Detection rules mapped to MITRE ATT&CK techniques
- Automatic IOC extraction from raw logs