Work Archive

Case studies for technical products and systems.

A focused archive of shipped product work across security, cloud governance, backend delivery, and frontend systems.

Sheet 04 / Component Specs

Exploded view — work

Each case study is framed by the user pressure, the system decision, and the product result it made possible.

Go SIEM Agent — LLM Classifier

In serviceSecurity · 2025

An AI-native SIEM agent written in Go that classifies any raw log line into a structured threat report — with MITRE ATT&CK mapping, IOC extraction, severity triage, and actionable remediation — in under 20 seconds, using a local-first LLM stack.

Materials

Go · React · Qdrant · Ollama · PostgreSQL · Docker · Prometheus

Performance

<20s per classification

40+ MITRE techniques

~3k lines Go

Notes

Turns hours of manual SOC triage into a sub-20-second automated pipeline, reducing analyst time spent on alert noise by eliminating rule-writing and manual MITRE mapping.

Open case file View source

ThreatRAG — Agentic Threat Intelligence RAG

In serviceSecurity · 2026

A spec-first, security-hardened RAG platform that answers analyst questions with cited sources from MITRE ATT&CK, OWASP, and NVD — then runs autonomous multi-agent investigations on any IOC end-to-end.

Materials

Python · FastAPI · LangChain · LangGraph · React · Qdrant · Ollama

Performance

<2s cited answer (TTFT)

39/39 tests passing

3 agent pipeline

Notes

Collapses hours of manual searching across MITRE ATT&CK, NVD, and OWASP into sub-two-second cited answers, and turns end-to-end IOC investigation into an autonomous Researcher→Critic→Reporter pipeline.

Open case file View source

File Ingestion Platform — Archive Parsing & IOC Extraction

In serviceSecurity · 2026

A local-first ingestion platform that takes a 10 GB password-protected archive, recursively unpacks it, detects and parses every member format, extracts ten classes of indicator from each record, and streams the results into PostgreSQL and OpenSearch — with live progress in a React dashboard.

Materials

Go · Python · React · PostgreSQL · Redis · MinIO · OpenSearch

Performance

10 GB single-file ingest

10 IOC classes/record

32 worker tests passing

Notes

Turns an opaque evidence blob into searchable, indicator-tagged records without the API ever touching the data path — and keeps 49,999 good extractions when one member of 50,000 is corrupt.

Open case file View source

Production API Delivery System

RestrictedBackend · 2024

A production backend and delivery system with authentication, payments, notifications, cloud storage, observability, and CI/CD.

Materials

Go · Gin · PostgreSQL · AWS · Docker · GitHub Actions

Performance

CI/CD release flow

AWS infrastructure

Go service layer

Notes

Improved release speed and reliability by making cloud delivery predictable and repeatable.

Drawing sealed — NDA

Developer Evaluation Platform

RestrictedFrontend · 2023

Internal learning and evaluation tools for developer education, mentoring, code review, and automated feedback workflows.

Materials

Node.js · React · MongoDB · Express · Testing · Mentoring

Performance

200+ developers

MERN core stack

QA reviews

Notes

Supported developer growth at scale through structured evaluation and clearer feedback loops.

Drawing sealed — NDA