Noble AntwiCloud Security & Identity Engineer
Work

Nine projects, each with a repository and a write-up.

Two long-running labs and a public website for a fictional bank, a cloud build in progress, three tools, and two graduate assessments. Every case study covers the objective, the architecture, what got built, the decisions behind it, and what is next.

9Case studies
4In active build
60Evidence screenshots
9Public repositories
How the projects fit togetherBiira Bank is built in three tiers. A public website on Cloudflare's edge, an identity estate of Active Directory federated to Okta and Entra ID, and the segmented network underneath both. Three cloud tools sit outside the bank: a posture dashboard for AWS and Azure, a cost optimiser, and an identity job scout.Biira Bank, a fictional regulated bankPublic tierbiirabank.comStatic site on Cloudflare Workers. Strict transport, security headers,no client-side scripting. Graded F to A+ by an independent checker.What the internet can reachsign-in hands off to Okta, plannedIdentity estatecorp.biirabank.comActive Directory with a tiered admin model, federated to Okta andMicrosoft Entra ID. Conditional access by network zone, graduated MFA.Forest rebuilt from a decision record. The Okta org is being rebuilt with Terraform.Who may reach whatruns onNetwork and detectionSix VLANs behind one default-deny firewallProxmox on a trunk port, a Wazuh SIEM with three agents, a Greenbonescanner whose identity holds nothing on the domain.What everything stands onCloud tooling, built to stand alonePostureCloud Security Posture DashboardTerraform plants the misconfiguration,Prowler and ScoutSuite find it.CostAWS Cost OptimizerA read-only command line tool thatnames the waste and never touches it.Identity careersIAM Job ScoutCollects identity roles, scores them,and reports on the market it sees.
One bank in three tiers, and the cloud tools beside it. Every tier has a case study, a repository and its evidence. Anything dashed is planned rather than built.
Hybrid identity architecture diagram: network zones and authentication policies above Okta and Entra ID, with Active Directory on premises reached by the Okta AD Agent
Identity · Hybrid identity · Biira BankPhase 5 of 6 · rebuilding

Enterprise IAM Lab: Hybrid Identity for a Regulated Bank

On-prem Active Directory with a tiered admin model, federated to Okta Workforce Identity and Microsoft Entra ID over SAML, OIDC and SWA, with network-aware conditional access and graduated MFA. Built to the regulatory drivers a real bank would have to satisfy, and now being rebuilt on a new forest from a written decision record.

Active DirectoryWindows Server 2025Okta Workforce IdentityMicrosoft Entra IDSAML 2.0OIDC
Read the case study →
Network architecture diagram: internet, pfSense, two switches and six VLAN security zones with firewall status, the hosts in each zone and their Wazuh agents
Infrastructure · Detection · Biira BankIn active build

Enterprise Security Homelab

A six-VLAN, default-deny network for a fictional regional bank: pfSense, managed switching, a Proxmox hypervisor on a trunk port, a Windows Server 2025 domain controller, a Wazuh SIEM with four agents and its own detection rules, a Greenbone scanner whose identity is administrator on member machines and nothing on the domain, a first finding found, fixed and proved closed, and every firewall rule justified and mapped to a NIST control.

pfSense802.1Q VLANsProxmox VEWindows Server 2025Wazuh 4.14Sysmon
Read the case study →
The biirabank.com homepage: a fictional bank's site with a banner stating it is not a real financial institution
Edge security · Cloudflare · Biira BankLive · hardening continues

biirabank.com: The Public Tier

Biira Bank's public website on Cloudflare Workers: zero JavaScript, a Content Security Policy with no script source at all, TLS 1.2 as the floor, and an independent security-header grade that moved from F to A+. Testing found the site still answering on a default hostname the zone's controls did not cover, and closed it.

Cloudflare WorkersStatic assetsWranglerHTMLCSSContent Security Policy
Read the case study →
Pipeline diagram: deploy misconfigured resources with Terraform, scan with Prowler and ScoutSuite, aggregate into one schema, visualise in Flask, remediate with dry-run
Cloud posture · AWS + AzureCompleted

Cloud Security Posture Dashboard

Terraform deploys deliberately misconfigured AWS and Azure resources, Prowler and ScoutSuite scan them, and a Flask dashboard normalises 500+ checks into one findings schema with remediation commands and CIS, NIST and PCI mapping.

TerraformProwlerScoutSuitePythonFlaskAWS
Read the case study →
Architecture diagram: three job APIs feeding a FastAPI service with PostgreSQL, a Jinja UI, and Prometheus and Grafana for monitoring
Identity · ToolingCompleted

IAM Job Scout

A FastAPI job board that pulls IAM roles from three job APIs, de-duplicates them with fuzzy matching, filters out senior titles, and ships with Prometheus metrics, a Grafana dashboard and Docker Compose deployment.

PythonFastAPIPostgreSQLDockerPrometheusGrafana
Read the case study →
Architecture: a React app built today; S3, CloudFront, API Gateway, a Python Lambda and DynamoDB planned, all defined as code and deployed by GitHub Actions
Cloud · AWS · ServerlessFrontend done · AWS next

Cloud Resume Challenge

A resume rebuilt as a cloud-hosted website through the AWS Cloud Resume Challenge: a React frontend with routed project pages is done; S3 and CloudFront hosting, a serverless visitor counter, infrastructure as code and CI/CD are the stages ahead.

React 19ViteReact RouterAmazon S3CloudFrontAPI Gateway
Read the case study →
Flow diagram: inventory every region, measure with CloudWatch, detect against thresholds, report in three formats
Cloud · ToolingWorking tool

AWS Cost Optimizer

A read-only Python CLI that scans every region of an AWS account for idle EC2 instances, unattached EBS volumes, outdated snapshots, unused Elastic IPs and idle RDS databases, using real CloudWatch utilisation rather than guesses, and reports the waste with a monthly and annual figure attached.

PythonBoto3CloudWatchEC2EBSRDS
Read the case study →
Audit lifecycle from planning through risk assessment, control testing and reporting to remediation, with the five findings ranked by severity
Assessment · IT auditAcademic · Completed

Collins Aerospace IT Audit: Post-Incident Assessment

A graduate IT-audit engagement on a simulated aerospace breach: COBIT-framed planning, NIST 800-30 risk assessment, CMMC Level 3 gap analysis, five headline findings and a costed remediation roadmap.

COBIT 2019NIST 800-30NIST 800-171CMMC 2.0ISO 27001
Read the case study →
Defense-in-depth layers (human, policy, technology) with the key findings and a three-phase rollout
Assessment · Security programAcademic · Completed

Cyberdyne Systems: Enterprise Security Assessment

A defense-in-depth program for a fictional 400-person manufacturer across two countries: 16 vulnerabilities, 13 technical controls, 11 policies, and a three-phase rollout that starts with the end-of-life fleet and identity.

NIST CSFNIST 800-171Active DirectorySIEMDefense in depth
Read the case study →

No projects in this category yet.

The repositories are public and the documentation is written so someone else could rebuild the lab.

Browse GitHubGet in touch