I build and test portfolio projects across IT systems administration, SOC Tier 1 incident triage and IAM review, and AI-assisted security automation (MCP).

• IT Systems Administration: Built tested PowerShell automation for Active Directory / Entra ID identity-lifecycle patterns and GPO audits, plus browser-based ITSM rollback risk scoring.
• Cybersecurity Ops & IAM: Portfolio projects demonstrate multi-source security log parsing (Windows EVTX, AWS CloudTrail, Syslog), MITRE ATT&CK mapping, legacy NIST SP 800-61 Rev. 2-style workflows, and example least-privilege review logic.
• AI Agentic Workflows: Built an MCP tool-calling security-triage lab that uses VirusTotal, AbuseIPDB, and AlienVault OTX adapters to produce structured, inspectable alert assessments.

Below are six core operational lab repositories demonstrating end-to-end technical depth across IT Automation, SOC Operations, IAM Compliance, and AI Engineering:

Live browser demos: Portfolio Portal · Signal Desk · Access Review Lab · Change Impact Studio · NetPulse

Additional Operational Repositories:

• NetPulse (live app): Canonical NOC/outage-monitoring application with a browser-local diagnostics workbench and a verified 100% line/function diagnostics-engine coverage gate.
• cybersecurity-hub (live portal): Unified portfolio portal with a verified 97.37% content-registry check.

To make an enterprise-style blue team build reproducible, I designed and documented this simulated reference architecture, its trust boundaries, telemetry flow, and detection scenarios. It is not a deployed end-to-end integration between the listed repositories.

graph TD
    subgraph External_Internet [External / Internet]
        ExtThreats[Simulated Threat Actors / External Feed]
        ThreatIntelAPIs[Threat Intel APIs: VirusTotal / AbuseIPDB / OTX]
    end

    subgraph Firewall_Gateway [Edge Gateway & Routing]
        PFSense[pfSense Firewall & Router / 10.0.0.1]
    end

    subgraph Subnet_Mgmt [VLAN 10: Management Subnet / 10.0.10.0/24]
        AdminWS[SysAdmin Workstation / PowerShell Core]
    end

    subgraph Subnet_AD [VLAN 20: Enterprise AD DS / 10.0.20.0/24]
        DC01[Windows Server 2022 AD DC / Entra ID Sync]
    end

    subgraph Subnet_Users [VLAN 30: User Workstations / 10.0.30.0/24]
        Win11[Windows 11 Enterprise Workstation / Sysmon Installed]
    end

    subgraph Subnet_SOC [VLAN 40: SOC Security Ops / 10.0.40.0/24]
        WazuhSIEM[Wazuh SIEM & Log Collector / Indexer]
        SignalDesk[signal-desk Log Parser & NIST Workbench]
    end

    subgraph Subnet_AI [VLAN 50: AI Agent Sandbox / 10.0.50.0/24]
        MCPAgent[secops-agent-triage: MCP AI Triage Agent]
    end

    ExtThreats -->|Inbound Attack Simulation| PFSense
    PFSense --> AdminWS
    PFSense --> DC01
    PFSense --> Win11
    PFSense --> WazuhSIEM
    PFSense --> MCPAgent

    AdminWS -->|Remote Admin / PowerShell| DC01
    DC01 -->|Kerberos / GPO Audit| Win11
    Win11 -->|EVTX / Sysmon Telemetry| WazuhSIEM
    WazuhSIEM -->|Alert Ingestion| SignalDesk
    SignalDesk -->|Trigger Alert Event| MCPAgent
    MCPAgent <-->|MCP Tool Calling / REST| ThreatIntelAPIs

• Network Segmentation: Reference design for five subnets, firewall rules, and isolated management channels.
• Identity & Policy: Reference AD DS, Entra ID hybrid-sync, Group Policy, and audit-logging design.
• Detection & Telemetry: Proposed Wazuh/Sysmon, Windows Event Log, and Syslog collection flow.
• AI-Powered Triage: Proposed handoff from Wazuh/SignalDesk to secops-agent-triage; the repositories are not wired together as a deployed pipeline.

• Open Roles: Seeking entry-level positions in IT Support Specialist, SOC Analyst Tier 1, IAM Analyst / Identity Specialist, or AI / Security Automation Engineering.
• GitHub: github.com/drummer475-94

Verification evidence and framework mappings are stated per project; lab outputs are not compliance determinations.