Security engineer and product builder creating defensive tools, Windows software and practical systems for teams that need clear evidence—not noise.
Most of what is here falls into two halves that keep feeding each other. On one side, shipped products: desktop applications people install, review and complain about, distributed through the Microsoft Store, winget and the usual software catalogues. On the other, security engineering: detection rules, forensic tooling and incident write-ups, each built to be run and checked rather than read and believed.
Working both sides changes how you build. Handling alerts for a living teaches you what an attacker actually does before your product's threat model is finished, and shipping to strangers teaches you that a control nobody can understand is a control nobody uses.
Website security monitoring and client-ready reporting for digital agencies. Glarion identifies meaningful changes, turns technical findings into clear deliverables and requires current proof of domain control before active scans. One site free · Solo €19 · Studio €39 · Agency €99 a month, per account rather than per site Check a website without an account · View the sample report · Read the security model | Windows performance, gaming, privacy and maintenance tuning where every change is snapshotted before it is applied, so any tweak can be reversed. 30,000+ downloads across all distribution channels · Microsoft Store · Softpedia users 5.0/5 · MajorGeeks 5.0/5 |
Catches secrets, credentials and personal data in text before it is pasted into ChatGPT, Claude, Gemini or Copilot. Scanned on our backend, never sent to an AI provider — details in the privacy section. Desktop app, browser extension and web version | Local-first analytics for YouTube, Instagram, TikTok and X. Credentials and history stay on the machine — the only exception is the Instagram/TikTok OAuth handshake, routed through a proxy that never sees your data. |
Practice tests for IT certification exam prep (Security+, CySA+ and other vendor tracks), built to mirror real exam format and scoring. | |
Each of these is a working tool rather than a write-up of something done once, and detection logic is validated against samples that should fire and samples that should not. Two of them — detection-engineering-rules and network-traffic-analysis — run that validation in CI; the labs and the DMA reference are documented work, not packaged tools with pipelines.
| Project | What it does |
|---|---|
| detection-engineering-rules | YARA and Sigma rules, each checked against true and false positive cases. Sigma is compiled to real Splunk SPL with pySigma rather than validated as YAML. |
| network-traffic-analysis | Scapy PCAP analyser for port scans, C2 beaconing and floods. A statistical baseline catches slow floods that fixed thresholds structurally cannot, with a side-by-side demo showing the difference. |
| malware-triage-hash | Hash reputation joined to behavioural scoring, so an unknown sample is not read as a clean one. Ships a Sentinel KQL hunt. |
| ransomware-dfir-timeline | Process, Prefetch, Registry and filesystem artifacts correlated into a single timeline, from the opened attachment to mass encryption, with root cause and detection gaps. |
| phishing-email-analysis | Parses raw .eml, extracts headers, URLs and attachment hashes, flags typosquatting and urgency patterns, enriches through VirusTotal. |
| splunk-brute-force-detection | SPL detections for brute force and password spraying in Windows Security logs, with threshold tuning notes and a triage playbook. |
| soc-home-lab | Wazuh and OpenSearch lab: custom rules, agent deployment, ingestion validation, and the full path from alert to incident report. |
| dma-guide | Reference on DMA attack mechanics and the controls that stop them, from IOMMU and VT-d to Kernel DMA Protection. |
Everything is mapped to MITRE ATT&CK and, where behaviour matters more than a screenshot, reproducible from the repository.
SOC analyst, currently Tier 1, handling alert triage, log correlation and detection tuning across Microsoft Sentinel, Splunk and Wazuh. Before the products there was the day job, and the day job is why the products are built the way they are.
Certifications
| Area | Skills, platforms and tools |
|---|---|
| Security operations | Alert triage · Incident investigation · Log correlation · Threat hunting · Detection tuning · Escalation and incident reporting · SOAR playbooks |
| SIEM and detection | Microsoft Sentinel · KQL · Splunk · SPL · Wazuh · OpenSearch · Sigma · YARA · pySigma · MITRE ATT&CK |
| DFIR and malware analysis | Windows event analysis · Process, Prefetch, Registry and filesystem artifacts · Timeline reconstruction · Hash reputation · Behavioural triage · VirusTotal API · Sandbox evidence |
| Network and email security | Wireshark · Scapy · PCAP analysis · Traffic baselining · Port-scan, beaconing and flood detection · Email header analysis · IOC extraction and enrichment |
| Application and AI security | Nuclei · SSRF protection · Domain ownership verification · Secret and PII detection · Data-loss prevention · LLM security · MCP fundamentals |
| Software development | Rust · TypeScript · Python · JavaScript · SQL · React · Tauri · FastAPI · Axum · PostgreSQL · REST APIs |
| Platforms and identity | Windows 10/11 · Linux and Ubuntu · Microsoft Azure · Microsoft Entra ID · Microsoft Store · winget |
| Engineering workflow | Git · GitHub · GitHub Actions · CI/CD · Automated testing · Visual Studio Code · Security scanning · Release automation |
| Threat-intelligence frameworks | STIX/TAXII · Pyramid of Pain · IOC lifecycle · Behaviour-to-technique mapping |
The technologies above are reflected in shipped products, reproducible security labs or day-to-day security operations. They are not a keyword inventory.
Languages — Italian (native), English (C1), French (B2), Spanish (B1)
aurelio_11@outlook.it · Amsterdam
Happy to talk about any of the products above, and open to security engineering work.