I design least-privilege access on AWS and Azure, run hybrid identity across Active Directory, Entra ID and Okta, keep secrets in HashiCorp Vault, and build the detection that catches what slips through. Then I write it down so someone else could rebuild it.
On-prem Active Directory with a tiered admin model, federated to Okta Workforce Identity and Microsoft Entra ID over SAML, OIDC and SWA, with network-aware conditional access and graduated MFA. Built to the regulatory drivers a real bank would have to satisfy, and now being rebuilt on a new forest from a written decision record.
Read the case study
A six-VLAN, default-deny network for a fictional regional bank: pfSense, managed switching, a Proxmox hypervisor on a trunk port, a Windows Server 2025 domain controller, a Wazuh SIEM with four agents and its own detection rules, a Greenbone scanner whose identity is administrator on member machines and nothing on the domain, a first finding found, fixed and proved closed, and every firewall rule justified and mapped to a NIST control.
Read the case studyWritten as I go, so they contain the mistakes as well as the fixes. 4 series so far: AZ-900, from zero to 873, HashiCorp Vault, hands on, Enterprise homelab notes, Identity certifications.
