01
Correlate clusters, not raw alerts
Raw counts exaggerate noise. Shared hosts and related events are the useful unit for triage.
02
Keep AI downstream of facts
Models can explain evidence, but should not become the database of record or mutate source identity.
03
Make the small machine a constraint
Async workers, bounded context, explicit configuration, and health checks matter on limited hardware.
What I would show in a technical interview
- How a new feed travels from configuration to enrichment to a reviewable alert.
- How suppressions reduce expected LAN noise without hiding meaningful aggregated behavior.
- How a model-context bug was reproduced, diagnosed, and corrected.
- How tests cover configuration, ingestion, APIs, correlation, and operational health.
Next deployment step
The next portfolio milestone is a sanitized AWS demonstration: synthetic events, least-privilege IAM, Terraform-managed infrastructure, CloudWatch health signals, and a deliberately small footprint.
Resume-ready summary: Built an AI-assisted security monitoring and alert-correlation platform integrating SIEM telemetry, threat intelligence, vulnerability context, and local LLM reasoning with provenance and operational guardrails.