Security Engineering · Detection Engineering · Secure AI · Security Automation
Berlin, Germany · Evidence-driven engineering with explicit claim boundaries
LinkedIn · TryHackMe · Coursera
Cybersecurity professional based in Berlin focused on security engineering, detection engineering, Secure AI and security automation.
I build security work around a consistent engineering principle: claims should be supported by reproducible technical evidence, explicit scope, documented limitations, traceable decisions and human accountability. My portfolio therefore emphasizes not only what a system can do, but also who is authorized to act, under which boundaries, how the action is verified and what evidence remains afterward.
My practical work includes a tested segmented private-cloud homelab, officer-bound AI-agent authorization architecture, governed Python SDK engineering, security/compliance automation and SOC-oriented network analysis.
MSIT GmbH — Master School Institute of Technology
| Certificate field | Official information |
|---|---|
| Course | Cybersecurity Bootcamp |
| Duration | 2,720 instructional hours · June 3, 2025 – August 3, 2026 |
| Specialization | Security Operations Center Analysis |
| Internship | 8 weeks · 320 hours |
| Credential ID | 43529502854875 |
| Issue Date | July 28, 2026 |
The course title Cybersecurity Bootcamp and specialization Security Operations Center Analysis are preserved exactly as stated on the completion certificate; descriptive German labels from the certificate are rendered here in English for consistency across the profile.
Selected curriculum documented on the certificate
- IT Support Fundamentals: Hardware, Software, Networking Troubleshooting
- Operating Systems: Windows & Linux Administration
- Network Architecture & Security: Firewalls, VPNs and Segmentation
- Cyber Threats Vulnerabilities & Mitigation Strategies
- Security Tools: SIEM, EDR, Packet Analysis, Forensics Basics
- Risk Management Governance & Compliance: NIST, ISO, GDPR, HIPAA
- Identity & Access Management (IAM): MFA and Authentication Protocols
- Data Security: Encryption, PKI and Secure Disposal Practices
- System Hardening, Patch Management and Secure Configurations
- Intro to SQL, Bash, Python Scripting and Automation
- Incident Response, Business Continuity and Disaster Recovery
- Virtualization & Cloud Fundamentals: IaaS, SaaS, VMs and Containers
- Advanced Network Design and Troubleshooting
- Network Defense and Secure Architecture
- Solo Project: Secure Network Implementation and Monitoring
- Internship: 8 weeks, 320 hours
These are the six repositories I recommend reviewing first. They are deliberately ordered to demonstrate complementary evidence across security infrastructure, Secure AI, software engineering, GRC and detection work.
| Priority | Project | Primary hiring signal |
|---|---|---|
| #1 | Cybersecurity Private Cloud Homelab | Native FreeBSD PF segmentation evidence, Suricata and Wazuh detection tests, IaC, threat modeling, evidence integrity and explicit deployment limits. |
| #2 | Officer-Bound Digital Investigation Agent | Secure AI authorization, human accountability, IAM boundaries, threat modeling, tested Go reference implementation and governed evidence. |
| #3 | Bonfim SDK | Governed Python SDK with strict typing, tests, SAST, SBOM, secret scanning, packaging and build provenance. |
| #4 | AI SaaS Security & Compliance Fit-Gap | TypeScript security/compliance automation spanning NIST CSF, ISO 27001, SOC 2, GDPR, EU AI Act and OWASP-oriented evidence assessment. |
| #5 | Gemini Security Engineering Study Lab | Tested synthetic event correlation with human validation, AI-risk controls and explicit separation between learned, demonstrated and unproven claims. |
| #6 | TShark SOC Case Study | Authorized network-forensics study covering phishing, HTTP analysis, IOC extraction and threat-intelligence correlation. |
For role-specific navigation and the wider repository classification, see PORTFOLIO_INDEX.md.
| Domain | Evidence represented in the portfolio |
|---|---|
| Secure AI & Agent Security | Human-bound authorization, default-deny execution, agent governance, secure automation and explicit authority boundaries |
| Cloud Security | Azure and Google Cloud controls, IAM, network exposure, encryption, logging, monitoring and risk decisions |
| Identity & Access Management | MFA, privileged access, least privilege, RBAC/ABAC, Zero Trust and identity-first security models |
| Security Operations | Network traffic analysis, IOC extraction, investigation structure, SIEM concepts and incident-response fundamentals |
| Security Governance / GRC | Control assessment, evidence management, audit readiness, risk communication, GDPR, ISO 27001 and NIST-aligned reasoning |
| DevSecOps / Supply Chain | GitHub Actions, CodeQL, SAST, SBOM, vulnerability scanning, secret detection, branch protection and provenance |
| Security Automation | Python, TypeScript, Bash and deterministic evidence/report generation |
Cybersecurity Intern — Berlin
8 weeks · 320 hours
- Assessed and documented cloud-security controls focused on encryption, IAM, logging, monitoring, backup and recovery.
- Supported GDPR and ISO/IEC 27001-oriented compliance activities through evidence collection and technical control validation.
- Reviewed TLS 1.3, HTTPS/HSTS and Microsoft Azure Storage encryption controls.
- Evaluated MFA, privileged access, audit trails and monitoring controls.
- Contributed to audit-ready technical documentation and Git-based review workflows.
Python · Go · TypeScript · Bash · Microsoft Azure · Google Cloud · IAM · MFA · Zero Trust · TLS 1.3 · PKI · GitHub Actions · CodeQL · SBOM · SAST · TShark · Wireshark · Nmap · Linux · Security Automation · Threat Modeling
GDPR · ISO/IEC 27001 fundamentals · NIST Cybersecurity Framework 2.0 · SOC 2 concepts · EU AI Act · OWASP · OWASP WSTG · OWASP Top 10 · PTES
- MSIT — Cybersecurity Bootcamp — 2,720 instructional hours — Security Operations Center Analysis
- Google Cybersecurity Professional Certificate
- Security in Google Cloud coursework and specialization certificates
- Google Cloud networking and Cloud NGFW training
- Generative AI: Governance, Policy, and Emerging Regulation — University of Michigan
- TryHackMe cybersecurity labs and learning paths
Every anchor project should make the following clear:
- Scope and authorization
- Individual contribution
- Methodology and tools
- Reproducible execution or validation steps
- Technical evidence and findings
- Risk interpretation and limitations
- Security and privacy safeguards
- Human decision boundaries where automation or AI is involved
- Extend the private-cloud homelab only through bounded, reproducible integration tests while keeping unproven deployment claims explicit.
- Preserve the OBDIA
v0.1.xbounded reference slice as the stable security baseline and evolve productionization separately. - Elevate Bonfim SDK through release hardening and later isolated-execution research.
- Harden the AI SaaS Security & Compliance Fit-Gap project as the primary GRC and AI-governance anchor.
- Expand SOC evidence with detection logic, investigation timelines and mapped response decisions.
Portuguese — native · German — professional working proficiency · English — working proficiency
Public repositories use authorized labs, synthetic data or sanitized examples. No active credentials, customer data, employer-owned internal identifiers or production secrets should be published.
Security concerns related to this profile repository can be reported according to SECURITY.md.