An AI-native SIEM agent written in Go that classifies any raw log line into a structured threat report — with MITRE ATT&CK mapping, IOC extraction, severity triage, and actionable remediation — in under 20 seconds, using a local-first LLM stack.

A spec-first, security-hardened RAG platform that answers analyst questions with cited sources from MITRE ATT&CK, OWASP, and NVD — then runs autonomous multi-agent investigations on any IOC end-to-end.

A local-first ingestion platform that takes a 10 GB password-protected archive, recursively unpacks it, detects and parses every member format, extracts ten classes of indicator from each record, and streams the results into PostgreSQL and OpenSearch — with live progress in a React dashboard.

A production backend and delivery system with authentication, payments, notifications, cloud storage, observability, and CI/CD.

Internal learning and evaluation tools for developer education, mentoring, code review, and automated feedback workflows.