Hi, I'm Ronan!
Cybersecurity Professional, MS Student @ Northeastern

🚀 Featured Projects

• Authorized Penetration Test, Metasploit Lab (CASE-19)

  • Conducted authorized penetration tests against two targets, a self-hosted Metasploitable2 VM and the TryHackMe Blue room, enumerating services with Nmap from Kali Linux before exploitation
  • Exploited 3 CVEs with the Metasploit Framework: CVE-2011-2523 (vsftpd backdoor), CVE-2007-2447 (Samba RCE), and CVE-2017-0144 (EternalBlue)
  • Documented 4 findings in a structured pentest report with CVSS scoring, MITRE ATT&CK mapping, and per-finding remediation recommendations
  • GitHub Repo

• Zeek Beacon Detector (OCaml) -- CASE-18

  • Ported the CASE-17 Python and RITA beacon-scoring logic to OCaml as a single-file dune executable, reimplementing interval-variance detection functionally to compare imperative and functional approaches to the same detection problem
  • Parses Zeek conn.log rows and groups them by source IP through Map.Make(String) at O(n log k), sorting per-IP timestamps and folding consecutive inter-arrival gaps into a population variance with List.fold_left -- no mutable state anywhere in the scoring path
  • Flags low-variance periodic senders as C2 beacon candidates at min_conns = 5 and a 5.0 seconds squared variance threshold; isolates 10.0.0.5 at a 477.1s mean interval and variance 1.84 across 6 connections against two high-variance talkers
  • Modeled results as a beacon_verdict variant (TooFewConns, HighVariance, BeaconCandidate), making an unscored IP structurally unrepresentable at the output printer and removing the sentinel-plus-assert guard the Python version required
  • GitHub Repo

• Zeek Network Forensics + Beacon Detection (CASE-17)

  • Ran Zeek 8.2.1 against a real SSLoad + Cobalt Strike PCAP (6.4MB, MTA 2024-04-18), generating 17 structured logs including conn.log, dns.log, ssl.log, kerberos.log, and ldap.log
  • Imported Zeek logs into RITA v5.1.2; scored all external connections for beacon regularity -- 85.239.53.219 flagged with rare_signature:SSLoad/1.1, beacon score 0.504, mean interval 477 seconds across 11 connections
  • Built 3 Jupyter threat hunting notebooks: conn.log duration analysis, DNS query profiling, and beacon interval visualization confirming C2 sleep timer pattern
  • Mapped findings to 6 MITRE ATT&CK techniques (T1071, T1071.004, T1008, T1095, T1557, T1018); produced IOC table and 2 Sigma detection rules in a full investigation report PDF
  • GitHub Repo

• Malware Analysis Lab: AgentTesla Static, Dynamic + Memory Forensics

  • Reverse engineered a real AgentTesla credential stealer using PEStudio, CAPA, and Ghidra 12.1.2; identified MurmurHash API hashing at FUN_1400015a0, XOR-encrypted strings (x16), and a fraudulent DigiCert certificate chain
  • Wrote 3 custom YARA rules from extracted indicators (imphash, MurmurHash seed bytes, structural heuristics) validated with YARA 4.5.5; zero false positives across System32
  • Detonated the sample in Any.run sandbox; confirmed Stealc/Vidar stealer behavior, 32 dropped files targeting Chrome/Edge credential stores, 87 IOCs, 11 MITRE ATT&CK techniques mapped
  • Acquired live memory from FlareVM with winpmem v4.0-rc1 (7GB dump), analyzed with Volatility 3; detected PAGE_EXECUTE_READWRITE code injection in SearchApp.exe and powershell.exe
  • GitHub Repo

• AppSec Pipeline + Secrets Management Lab

  • Wrapped OWASP WebGoat with a 3-gate CI/CD security pipeline: Semgrep SAST (66 findings across 1,002 files), Checkov (3 Dockerfile misconfigurations), Trivy (71 CVEs in container image)
  • OWASP ZAP active scan (961 requests) found 8 vulnerability categories including missing CSRF protections
  • Migrated credentials into HashiCorp Vault KV engine with secret rotation demo; configured Okta OIDC SSO with MFA enforcement via Okta Verify
  • Mapped full environment against 16 PCI-DSS 4.0 requirements with an accepted risk register
  • GitHub Repo

• Access-Governed RAG Console (LLM Access Control + Entra ID SSO)

  • Built a RAG assistant that enforces role-based access control at the retrieval layer, so restricted documents are excluded from a non-authorized user's candidate set before the model ever sees them
  • Integrated real Microsoft Entra ID (OAuth2) sign-in with app-role claims mapped to backend RBAC, plus a demo-login fallback so the repo runs with zero external setup
  • Added a prompt-injection scanner (validated by a 10-case attack battery, 10/10 resisted) and full audit logging of every access decision; deployed to Azure App Service
  • GitHub Repo

• NIST 800-171 / CMMC Compliance Baseline Lab

  • Configured Active Directory, Group Policy, Microsoft Intune device compliance, and Entra ID Conditional Access requiring device compliance for cloud app access
  • Hardened Windows Defender Firewall rules and authored a System Security Plan mapping every control to its NIST 800-171 requirement
  • Built a CMMC Level 2 self-assessment scorecard scoring 12 of 15 practices met, with remaining gaps documented as next steps
  • GitHub Repo

• Agentic SOC Analyst (Microsoft Sentinel + Claude AI)

  • Built an agentic AI-powered SOC analyst integrating Microsoft Sentinel with Claude AI
  • Automated KQL query generation, alert triage, and MITRE ATT&CK threat mapping
  • Designed for real-world incident detection and AI-assisted response workflows
  • GitHub Repo

• AWS CloudTrail Threat Detection Pipeline

  • Engineered a serverless threat detection pipeline using CloudTrail, Lambda, SNS, and DynamoDB
  • Implemented 11 detection rules mapped to MITRE ATT&CK, covering Defense Evasion, Privilege Escalation, and Credential Access
  • Confirmed end-to-end real-time email alerting with 100% Lambda execution success rate across 6 invocations
  • GitHub Repo

• Suricata IDS + ELK Stack on AWS EC2

  • Deployed Suricata 7.0.3 IDS on AWS EC2 with custom detection rules monitoring live network traffic
  • Built a log ingestion pipeline (Suricata to Filebeat to Elasticsearch) indexing 110+ security events
  • Designed Kibana dashboards visualizing alert signatures and event type distribution
  • GitHub Repo

• S3 Security Auditor

  • Built a Python (boto3) tool to audit AWS S3 buckets for misconfigurations
  • Performed 6 security checks per bucket covering public ACL, encryption, versioning, and logging with severity classification
  • Generated structured JSON risk reports for remediation tracking
  • GitHub Repo

• SOC Automation Lab with AI Threat Analysis

  • Built end-to-end security pipeline: Windows to Splunk to n8n to OpenAI to Slack
  • Automated threat detection with MITRE ATT&CK mapping and AI-powered analysis
  • Achieved under 60s detection and under 9s processing time for security incidents
  • GitHub Repo | View Demo

• SOC 2 Type I Audit Simulation

  • Conducted a simulated SOC 2 Type I audit of a personal SOC automation lab
  • Produced formal deliverables: risk assessment, control mapping, and findings report
  • Demonstrated GRC skills including trust service criteria, evidence collection, and gap analysis
  • GitHub Repo

• Fake Job Posting Detection (Published Research: IEEE ICAISS 2025)

  • Detected fraudulent job listings using ensemble ML (Random Forest, XGBoost, Gradient Boosting, AdaBoost)
  • Achieved 98% accuracy across 9,000+ records using SMOTE/ADASYN class balancing
  • Presented at the 3rd International Conference on Augmented Intelligence and Sustainable Systems (ICAISS 2025)
  • Read the Paper | GitHub Repo

• Kali Linux SSH MCP Bridge

  • Built a Claude Desktop to Kali Linux SSH bridge via Model Context Protocol (MCP)
  • Enables AI-assisted penetration testing and security research directly from Claude Desktop
  • Bridges natural language commands to live Kali Linux terminal execution
  • GitHub Repo

• Security Analysis and Hardening Projects

  • Network Security: Configured firewalls, VPNs, and IDS/IPS using Snort with Wireshark analysis
  • Web Security: Built SQL injection detection system and analyzed database security vulnerabilities
  • Linux Hardening: Automated security configurations implementing CIS benchmarks
  • Network Security Report | SQL Analysis | Linux Guide

📖 Coursework

• CS-5770: Software Vulnerabilities and Security

  • Hands-on security challenges: network forensics, web exploitation, privilege escalation
  • Documented methodologies for packet analysis, SQL injection, command injection, Unix security
  • Tools: Wireshark, Nmap, Burp Suite, SQL injection techniques, privilege escalation
  • Private repo (course policy). Write-ups available on request.

• CY5001: Cybersecurity Technologies, Threats and Defense

  • Comprehensive coursework in Linux security, cryptography, and network defense
  • Implemented GPG/PGP encryption, OpenSSL operations, digital signatures, and hybrid encryption
  • Built automated security scripts for system hardening and threat detection
  • Skills: Linux administration, Bash scripting, AES/RSA encryption, digital envelopes, log analysis
  • Private repo (course policy). Write-ups available on request.

🏆 Professional Experience

Industry Simulations and Virtual Internships

• ✅ Deloitte Cybersecurity Simulation

  • Conducted vulnerability assessments and penetration testing
  • Developed security policies and incident response procedures
  • Created executive-level security reports

• ✅ Tata Cybersecurity Analyst Simulation

  • Performed threat hunting and malware analysis
  • Implemented security controls and monitoring solutions
  • Analyzed security logs and created incident timelines

Internships

• NIELIT Cybersecurity Internship (Summer 2024)

  • Monitored SOC operations and analyzed security alerts
  • Configured SIEM rules and correlation policies
  • Participated in incident response exercises

• Quizaro Web Development (Spring 2024)

  • Developed secure web applications with input validation
  • Implemented OAuth 2.0 and session management
  • Conducted security code reviews

• Rejolt Data Science (Winter 2023)

  • Built ML models for anomaly detection
  • Analyzed large datasets for pattern recognition
  • Created predictive analytics dashboards

📚 Certifications and Training

• Google Professional Cybersecurity Certificate (Completed 2025)
  • 8-course comprehensive program covering security fundamentals, network security, incident response, and Python automation

View Individual Course Certificates

• Foundations of Cybersecurity: Certificate
  • CIA triad, security frameworks, threat modeling
• Risk Management: Certificate
  • Risk assessments, security controls, compliance
• Network Security: Certificate
  • TCP/IP, subnetting, firewall configuration, VPNs
• Linux and SQL Security: Certificate
  • System hardening, database security, log analysis

Quick References:

• Linux Commands Guide
• SQL Security Reference
• Cybersecurity Glossary

🎓 Education

• MS Cybersecurity (2025 to 2027) -- Northeastern University, Boston

  • Relevant Coursework: Software Vulnerabilities and Security (CS-5770), Cybersecurity Technologies, Threats and Defense (CY5001), Network Forensics
  • Focus: Applied cryptography, secure systems, threat analysis

• B.Tech AI and Data Science (2021 to 2025) -- Vardhaman College of Engineering

  • Focus: Machine Learning, Data Mining, Statistical Analysis
  • GPA: 3.8/4.0
  • Capstone: AI-based Intrusion Detection System

💼 Technical Skills

Network Forensics: Zeek • RITA • Wireshark • Beacon Detection • PCAP Analysis • Jupyter
Malware Analysis: PEStudio • CAPA • Ghidra • YARA • CAPE Sandbox • Any.run • winpmem • Volatility 3
Security Tools: Splunk • Microsoft Sentinel • Metasploit • Nmap • Burp Suite • Nessus • Suricata
Identity and Compliance: Active Directory • Group Policy • Microsoft Entra ID • Microsoft Intune • Conditional Access • NIST 800-171 • CMMC
Cloud Security: AWS CloudTrail • AWS Lambda • Amazon S3 • boto3 • Azure • Azure App Service
AI and Automation: Claude AI • OpenAI GPT-4 • n8n • Model Context Protocol (MCP) • RAG • LLM Security • Prompt Injection Defense
Cryptography: OpenSSL • GPG/PGP • AES • RSA • Digital Signatures
Programming: Python • SQL • Bash • PowerShell • KQL • JavaScript
Platforms: Linux • Windows Server • Docker • VMware • AWS • Azure
Frameworks: MITRE ATT&CK • NIST SP 800-30 • NIST SP 800-171 • CMMC • CIS Controls • OWASP Top 10 • SOC 2

📫 Connect With Me

---

Currently seeking Summer/Fall 2027 cybersecurity co-op/internship opportunities in Security Operations, Incident Response, Malware Analysis, Detection Engineering, Network Forensics, or AI/LLM Security