Technical execution. Evidence that holds.

SOC & SIEM Performance

Security & Compliance

Cloud & AI Engineering

// Brute Force Login Detection
SigninLogs
| where TimeGenerated > ago(1h)
| where ResultType !in ("0", "50125", "50140")
| summarize FailedAttempts = count(),
            DistinctIPs = dcount(IPAddress)
            by UserPrincipalName, bin(TimeGenerated, 5m)
| where FailedAttempts > 10
| extend RiskLevel = iff(FailedAttempts > 50,
  "HIGH", "MEDIUM")
| project TimeGenerated, UserPrincipalName,
          FailedAttempts, DistinctIPs, RiskLevel

// Lateral Movement via PTH
SecurityEvent
| where EventID == 4624
| where LogonType == 3
| where AuthenticationPackageName == "NTLM"
| where WorkstationName != ComputerName
| summarize Hops = dcount(Computer),
            Targets = make_set(Computer)
            by SubjectUserName, IpAddress
| where Hops > 3
| extend ThreatScore = Hops * 10
| project SubjectUserName, IpAddress,
          Hops, Targets, ThreatScore

// Anomalous Data Upload
AzureNetworkAnalytics_CL
| where TimeGenerated > ago(24h)
| where FlowDirection_s == "O"
| summarize TotalBytes =
  sum(BytesSentToInternet_d)
  by SrcIP_s, bin(TimeGenerated, 1h)
| where TotalBytes > 100000000
| join kind=leftouter (
    DeviceNetworkEvents
    | where ActionType == "ConnectionSuccess"
  ) on $left.SrcIP_s == $right.LocalIP
| project SrcIP_s, TimeGenerated, TotalBytes

// Privilege Escalation Detection
SecurityEvent
| where EventID in (4720, 4722, 4728, 4732)
| where SubjectUserName !in ("SYSTEM", "root")
| summarize EscalationCount = count(),
            TargetAccounts = make_set(
              TargetUserName)
            by SubjectUserName, Computer
| where EscalationCount > 5
| extend AlertSeverity = "High"
| project SubjectUserName, Computer,
          EscalationCount, TargetAccounts

CAF A-D Evidence Production

Produced IGP scoring matrices, evidence packs, control mapping documents, and gap analysis reports for all 4 CAF objectives: A (Governance), B (Protect), C (Detect), D (Respond & Recover). Delivered to NCSC-reporting regulators.

ISO 27001 → CAF Control Mapping

Cross-mapped ISO 27001 Annex A controls to CAF objectives, producing control equivalence matrices that eliminated duplicate assessment effort and reduced compliance overhead by ~40%.

NIS Regulatory Submissions

Produced end-to-end NIS submissions for Operators of Essential Services across energy and finance. All submissions accepted by sector regulator on first presentation. Zero remediation demands.

GovAssure CAF Self-Assessment

Advisory and delivery support for UK government departments completing GovAssure annual self-assessments against the NCSC CAF. Produced scoring matrices, evidence libraries, and gap remediation plans across all 900 CAF security principles for Cabinet Office reporting.

SOC 2 Type 2 Readiness & ISO 27005 Risk Assessments

Prepared enterprise technology vendors for SOC 2 Type 2 audit — scoping Trust Services Criteria, designing control environments, and producing evidence packages. Conducted ISO 27005:2022 scenario-based risk assessments as part of ISO 27001 ISMS implementation programmes.

Azure Cloud Architecture

Hub-Spoke network topology design, AKS/Kubernetes cluster hardening, Azure Functions serverless, Logic Apps SOAR integration, and private endpoint security across multi-region deployments. €480K/year cost optimisation delivered.

DevSecOps & IaC

Terraform and ARM/Bicep for infrastructure-as-code. Azure DevOps and GitHub Actions CI/CD pipelines with integrated SAST/DAST gates. Docker, Helm, and GitOps deployment patterns. Blue-Green and canary release strategies.

Data & Backend Engineering

.NET Core 8 (C#) and Python (FastAPI/Flask/Django) backend systems. Azure Synapse Analytics, Databricks (Apache Spark, Delta Lake), Data Factory pipelines, Cosmos DB, MongoDB, and Redis for enterprise-scale data platforms.