Beyond the two case studies

More work

A SIEM pointed at my own machine, a personal project built around a pharmacokinetic model, the tooling and data work I’ve taken on since graduating, and the academic work three years of the degree produced.

Home lab

A SIEM pointed at my own machine.

I wanted to see my own PC the way a defender would, so I stood up a single-node Wazuh SIEM in Docker, bound to localhost and reachable from my other devices only over a private Tailscale network, and fed it six log sources, Sysmon among them. The first baseline came back with 1,556 alerts and nothing pointing to a compromise, but every one of the highest-severity alerts traced back to the same harmless thing: a throwaway script PowerShell writes and runs to test whether scripts are allowed. My first suppression rule didn’t match, and I only caught it because I triggered the behaviour on purpose rather than trusting the reload. Wazuh stores those Sysmon paths with doubled backslashes and my pattern didn’t allow for it, so I worked the fix through its rule tester.

Then I acted on what it surfaced: five outdated applications removed, memory integrity on, four attack surface reduction rules set to block and Controlled Folder Access enabled. I also changed the indexer’s admin password, which only took effect once the security config was reloaded (I checked that the new password returned 200 and the old one 401).

The lesson I value most came afterwards. A sweep of my drives found a genuine but long-outdated copy of WinRAR still carrying the library behind CVE-2018-20250, in a folder Wazuh’s software inventory couldn’t see, because that inventory only knows what Windows has registered as installed. I quarantined 25 WinRAR files rather than deleting them, with a SHA-256 manifest and written steps to restore them, and came away knowing an inventory is only as complete as what it can see.

Personal project

APEX. Four pillars, one record.

A private tracker I built for my own training, recovery, supplements and lab results. Doses and sessions go in, and the app models how much of each supplement or prescribed medication is still active from its published half-life, projects that a week forward, and plots it against my body and lab trends. The part that actually interested me is the pharmacokinetics: every entry decays on its own exponential curve, absorption and elimination run at different rates, and overlapping doses have to sum correctly across weeks. I built it local-first on purpose: reminders are scheduled on the device, cloud sync is optional, and the whole record exports as JSON I actually own.

More recently I connected it to my Apple Health data. My phone exports 43 metrics every hour, a small Node bridge on my PC mirrors them into the app’s cloud database every fifteen minutes, and a set of Python scripts turns the same export into daily, weekly and monthly recaps, with dashboards I publish to my phone. The bridge taught me the most when it broke: renaming a folder left its scheduled task pointing at a path that no longer existed, so it failed quietly for about a month, and a week without writes let the free-tier database pause itself. I fixed the path, restored the database, checked that all 42 days had landed, and added a keep-alive that holds the database awake through quiet weeks. If it can’t reach the database now, the task fails outright instead of reporting success.

APEX Today screen: doses due, modelled active levels, recovery metrics and weight — Today: what is due, modelled active levels, and recovery, weight and training against goal at a glance.

APEX workout logger showing exercises, sets, weight and reps with a session volume total — Train: sets, weight and reps per exercise, with session volume totalled as you log.

APEX library screen listing supplements and prescription medications, each with its route and half-life — Stack: the library the model runs on, each entry carrying the published half-life its decay curve is built from.

Since graduating

Tooling and data

Guardrails for my own tooling

A lot of my own projects run through Claude Code, so I look after its setup like any other system I’m responsible for. An audit in September found five faults that had gone unnoticed, including a backup that had never actually been scheduled. That’s where my rule of thumb comes from: a task that can succeed while doing nothing eventually will. Any hook I port now has to pass a differential test against the original; moving the command guard from PowerShell to Node took it from 286 to 60 ms.

PowerShell286 ms

Node60 ms

Time the guard adds to every shell call, nearly all of it PowerShell starting up. The Node port matched the original on 46 of 47 test cases; the 47th was a deliberate fix.

Claude Code · Node.js · PowerShell · Python · Differential testing

Session ledger

I wanted an honest record of what each working session changed, so I wrote a Claude Code skill that logs each one to a single journal, then checks my standing notes against what the session actually did. One log on purpose: per-folder notes had once forked into eight copies with the same facts drifting apart. Publishing beyond the local journal is off by default. When two of six evaluation runs died on a spending limit, I reported the four that finished and dropped that test rather than filling the gap with a plausible number.

Session ends. A hook adds it to a queue.
Record. One entry goes into that month’s journal.
Reconcile. Notes the session proved wrong get corrected.
Graph check. Files the knowledge graph hasn’t seen get flagged.
Publish elsewhere. Off until I turn it on.

Queued is not logged: nothing writes an entry until the skill runs.

Agent skills · Python · Evaluation · PowerShell

Workspace knowledge graph

My coursework, career documents, app code and notes live in one folder tree too big to search reliably, so I built a single knowledge graph over it with graphify: 6,067 nodes and 11,525 edges. The audit was the real work: nearly half the edges cited paths that didn’t resolve, so I wrote an idempotent repair that only rewrites a path when the result exists on disk. My transcript is left out on purpose, because its PDF extracts marks against the wrong subjects.

graphify · Python · Knowledge graphs · Data integrity

Eleven years of Spotify

I turned my full listening history, more than 364,000 plays and about 10,300 hours, into one interactive page with seven written findings and charts that filter each other. The build is plain Node with no dependencies and refuses to produce a page unless the data checks out, down to a seeded 1,000-row sample decoding back field for field. Where a short trip could just as easily be a connection routed through another country, the page labels it ‘Travel?’ rather than stating the guess as fact.

Stacked bar chart of listening time by genre for each year from 2015 to 2026: pop, rock and indie lead 2015, rap takes over from 2016, and from 2023 three hard dance families grow to nearly half of listening — Share of listening time by genre, per year. The three hard dance families arrive in 2023.

Node.js · Data visualisation · Data validation

Academic work

What the subjects produced

ML IoT Anomaly Detection Pipeline

Capstone. Isolation Forest trained on the IoT-23 dataset, served via a Flask API on a Raspberry Pi 4B, live predictions feeding an Elastic and Kibana dashboard for real-time triage.

Python · Machine learning · Elastic · Kibana · Flask

View repo

Windows Digital Forensic Investigation

Full examination of forensic disk images: hash-verified integrity, artefact recovery and correlation with Autopsy, FTK Imager and Eric Zimmerman tools, counter-forensics identified (JPEG/ZIP polyglot, AES archives). Delivered as a court-style expert report.

Digital forensics · Autopsy · FTK Imager · Windows artefacts

Cross-Platform Browser Forensics

Brave, Firefox and IceCat compared across Kali Linux and macOS, replicating identical activity on each so the artefacts lined up: cookie and history databases read in DB Browser for SQLite, plus cache, local and session storage, IndexedDB and tracker blocking, closing on a per-browser deployment recommendation. Scored 75/75, with 20/20 on the presentation.

Browser forensics · SQLite · Kali Linux · macOS · Wireshark

Healthcare Security Assessment

Contributed to a group security assessment of a healthcare provider holding 800,000 patient records and 2 million administrative records. Each policy gap worked through its risks, threats, countermeasures and exposure under the Privacy Act 1988, ending in four action areas answered with MFA, password rotation, RBAC and VPN restriction, plus a staff training programme designed against published awareness research.

Governance · Risk assessment · Privacy Act 1988 · Security awareness

APT38 Incident Response Plan

Incident response plan for a simulated APT38 intrusion against a financial institution, mapped to the cyber kill chain and MITRE ATT&CK, structured on the ACSC template with NIST and SANS lifecycle stages.

Incident response · Threat intel · MITRE ATT&CK · NIST

ML Security Classifiers

Spam, network intrusion and DDoS detection classifiers in Python (scikit-learn, TensorFlow, PyTorch), evaluated on accuracy, precision and recall, and tested against adversarial ML evasion.

Python · scikit-learn · TensorFlow · Adversarial ML

Loan Default Prediction Pipeline

Supervised classification on a 35,000-record lending dataset: EDA, engineered temporal features, a deliberate missing-data strategy and a held-out 15,000-prediction submission, including a date-format bug caught before it silently corrupted half the test set.

pandas · scikit-learn · Feature engineering · Data quality

Consumer Behaviour Analysis · Penang

Team project at Universiti Sains Malaysia: survey data cleaned and modelled in JMP and R, then built into a Tableau dashboard and presented to the cohort at the close of the school.

JMP · R · Tableau · Power BI · Mixed international team

Full coursework breakdown, in long form

Skills

The short version

Security operations

SIEM (Wazuh, Elastic & Kibana) · Sysmon and detection tuning · log analysis · Windows hardening · incident response · digital forensics · MITRE ATT&CK · AWS cloud security · Wireshark

Building software

Python (scikit-learn, TensorFlow, PyTorch) · JavaScript & TypeScript · Next.js · Supabase (Postgres, RLS) · offline-first PWAs · Docker · Git & CI

Analytics

pandas · feature engineering · JMP · R & RStudio · Tableau · Power BI · model evaluation and adversarial testing

AI tooling

Anthropic Claude and Claude Code · agent skills, hooks and MCP connectors · evaluation and differential testing · prompt and context design · AI-assisted development, review and documentation

Privacy & decentralisation

VPNs · explored cryptocurrency and blockchain

Certifications

Diploma of Information Technology, Deakin College (2023)

Hiring in Sydney?

Graduate cyber security or sales engineering.

Australian citizen, eligible for a security clearance, open to opportunities.

Get in touch