Project write-ups
High-level summaries of independent projects in security, data, and automation. Each entry describes the problem, the approach, and the outcome. Client work, internal systems, and implementation details are intentionally omitted.
Security · Threat intelligenceTrustedChain: a threat-intelligence classification service
Security teams receive a constant stream of indicators, and the cost of triage, not the volume of data, is what limits response. TrustedChain was built as a public service that classifies domains, IP addresses, and file hashes against a large, continuously refreshed set of curated indicator feeds and returns a verdict with its supporting evidence.
Approach
- Daily ingestion and de-duplication of several hundred thousand indicators from open feeds into a single verified store.
- Three answer modes: direct feed lookup, model-assisted classification, and a retrieval-augmented mode that cites the evidence behind each verdict.
- Design priorities were precision and explainability so that an analyst can trust and act on the result without re-checking it.
Outcome
A live service and API with an analyst-oriented interface, nightly rebuilt data, and off-site backups. It demonstrates end-to-end ownership from data engineering through detection logic to production operations.
Detection engineeringIOC feedsAPI design
Security monitoring · GovernanceBuilding a self-hosted security-monitoring and hardening programme
A mixed estate of cloud servers, on-premise hosts, and embedded devices needs the same visibility that a corporate environment expects: centralised logging, file-integrity monitoring, threat-intelligence enrichment, and alerts that mean something. The objective was to run this as a programme rather than a tool installation.
Approach
- Deployed an open-source SIEM with agents on every host, custom detection rules for the services actually in use, and enrichment from the threat-intelligence service above.
- Defined a hardening baseline for production services and a routine that verifies backups by size and restore test rather than by exit code.
- Produced an executive dashboard that reports agent coverage, alert trends, and control status in a form suitable for non-technical review.
Outcome
Continuous monitoring across all environments, documented procedures for onboarding hosts and tuning rules, and a repeatable evidence trail of the kind auditors expect.
SIEMFile-integrity monitoringHardening baselineExecutive reporting
AI systems · Security architectureAn operating model for AI agents with least privilege
Autonomous AI agents can accelerate operations and research, but they introduce a new class of risk when they hold tool access and credentials. This project defined and operated a multi-agent workflow where planning, execution, review, and follow-up are separated into distinct roles with bounded permissions.
Approach
- Per-agent scoped credentials and network isolation, with a central gateway that routes requests to language models and enforces per-consumer keys and rate limits.
- Human-in-the-loop approval for sensitive actions such as production changes, secret handling, and outbound messaging.
- Audit-friendly execution: every action is logged, changes are documented in the same step they are made, and backups precede any heavy infrastructure action.
Outcome
A working set of agents used daily for operations, monitoring, and research, with a written playbook covering role selection, guardrails, and escalation. The guardrails were themselves reviewed with a SIEM rule set that alerts on abnormal agent behaviour.
Least privilegeOrchestrationObservabilityPolicy
Product · Data engineeringA bilingual real-estate valuation platform on public data
Licensed property appraisers spend much of their time collecting comparable transactions and formatting reports. This platform automates the evidence gathering while keeping the professional judgement, and the signature, with the appraiser.
Approach
- Nightly ingestion of more than a million public deed records and hundreds of thousands of daily listings from several portals, joined by canonical location keys.
- A market-comparables engine that refuses to estimate on thin data rather than produce a misleading number, and separates automated estimates from signed valuations in both terminology and reporting.
- Arabic and English interfaces, signed PDF reports aligned with the national valuation standard, a data-quality dashboard, and administrative controls including a kill switch for document upload.
Outcome
A production platform with daily data pipelines, monitored backups, utilisation dashboards, and a documented deployment procedure. The work covered product design, data engineering, security controls, and operations.
Data pipelinesPostGISReportingAccess control
IoT · Edge AIEdge video analytics with local-only processing
Camera analytics usually means sending video to a cloud service. The requirement here was the opposite: object and face recognition on premises, with no footage leaving the network, on low-cost hardware.
Approach
- An open-source NVR on a single-board computer with a hardware AI accelerator for inference, tuned stream profiles to stay within the CPU budget, and a pinned driver build that survives kernel upgrades.
- Event-driven integration with the home-automation platform over MQTT for presence, alerts, and dashboards.
- Authentication and network allow-listing for every exposed service, with an incident write-up for each stability issue and its root cause.
Outcome
A reliable, privacy-preserving analytics system that has run continuously, together with documentation on capacity limits and failure modes that informs any future hardware changes.
Computer visionMQTTReliability engineering
IoT · SaaSA multi-tenant device-management platform for smart buildings
Property operators managing many units need a single view of locks, switches, and sensors across buildings, with remote control and per-unit accountability. This platform provides that view as a multi-tenant service.
Approach
- Tenant isolation at the data and API layers so that each operator sees only its own properties and devices.
- Live device status, remote control, per-unit energy tracking, and an API for automation partners.
- Rotated deployment credentials and a hardened hosting footprint as part of the standard operating procedure.
Outcome
A deployed platform serving real properties, with the security and operations practices from the other projects applied from the start.
Multi-tenantDevice APISmart buildings