Video & Animation

Configure a GitLab CI/CD pipeline that embeds SAST (Semgrep, SpotBugs, Gosec, Bandit, NodeJsScan), DAST, container scanning, dependency scanning, and secret detection via GitLab

Configure SAML 2.0 identity federation between on-premises Active Directory (via AD FS or a third-party IdP) and Microsoft Entra ID, covering federation models (AD FS, password hash sync, pass-through auth, third-party IdP) and the SAML authentication flow. Use when extending on-premises authentication authority to cloud resources or designing hybrid identity SSO architecture for Entra ID.

Builds vendor-agnostic detection rules using the Sigma rule format for

Builds real-time incident response dashboards in Splunk, Elastic, or

Design identity governance and lifecycle (IGA) programs on platforms like SailPoint, Saviynt, or Entra ID Governance, covering joiner-mover-leaver (JML) automation, role mining, access requests, periodic recertification, and orphaned-account remediation sourced from an HR feed. Use when automating cross-system JML provisioning, remediating former-employee access, or building lifecycle processes for SOX, HIPAA, or GDPR compliance.

Build dumb-pipe and traffic-filtering C2 redirectors with nginx (proxy_pass) and Apache (mod_rewrite), deriving filter rules from a Malleable C2 profile, layering Let

Deploy and harden a Sliver C2 team server (BishopFox

Deploy Microsoft Sentinel as a cloud-native SIEM/SOAR by configuring multi-cloud data connectors (AWS, Azure, GCP), writing KQL detection and hunting queries, and building automated Logic Apps response playbooks. Use when establishing a centralized SOC for multi-cloud environments, migrating from a legacy SIEM, or performing petabyte-scale threat hunting; not for AWS-only setups where Security Hub/GuardDuty suffice or for endpoint EDR needs.

Builds an automated malware submission and analysis pipeline that collects

Build collaborative forensic incident timelines using Timesketch to ingest,

Build effective detection rules using Splunk Search Processing Language

Auditing Terraform infrastructure-as-code for security misconfigurations

Audit MCP servers for tool poisoning, tool shadowing, rug pulls, SSRF, and unauthenticated exposure using Invariant Labs

Monitors Certificate Transparency (CT) logs to detect unauthorized certificate

Auditing Kubernetes cluster RBAC configurations to identify overly permissive

Auditing Google Cloud Platform IAM permissions to identify overly permissive

Drive the AADInternals PowerShell toolkit to perform Microsoft Entra ID tenant reconnaissance, access-token acquisition across Microsoft APIs, and federation/AD FS backdoor testing (Golden SAML, T1606.002) for defensive validation. Use during an authorized Entra ID/Microsoft 365 red-team assessment to map external attack surface or verify AD FS signing certs resist Golden SAML.

>-

>-

Analyze Windows Shellbag (BagMRU) registry artifacts with SBECmd and

Test RAG vector stores (Pinecone, Qdrant, Weaviate, Chroma, pgvector,

Enumerate Microsoft Entra ID (Azure AD) tenants with ROADrecon and

Run OAuth 2.0 device-code and illicit-consent phishing attacks against

Systematically audit AWS S3 bucket permissions to identify publicly