- 🛡️ Security engineer with 8+ years across cybersecurity, enterprise infrastructure and network security
- 🏢 Running threat detection and endpoint defence for ~50 managed enterprise tenants at an Australian MSSP
- 🤖 Moving into AI security — securing LLM and agentic workloads, and using AI to make SOC work faster without making it sloppier
- 🛠️ I build what I need: SOC automation pipelines, KQL libraries, Claude Agent Skills, and full-stack apps on TypeScript + Supabase
- 🧱 Came up through infrastructure (Windows Server, AD, VMware, backup/DR) — which is what turns a three-hour incident into a five-minute false positive
- 🎓 Reading an Executive MSc in Information Security (Asia e University, Nov 2025 – Dec 2026)
Working belief — a detection you can't explain in a ticket note isn't a detection, it's a guess.
| Project | What it is | Stack |
|---|---|---|
| SOC automation pipeline | Automated threat intel and alert enrichment for an MSSP SOC | n8n · Supabase · Claude |
| claude-skills · private | Version-controlled Agent Skills for SOC triage, CVE advisories and exposure analysis | Claude · Markdown · PowerShell |
| sc500-field-manual | Field notes I used to pass Microsoft SC-500 (Cloud & AI Security Engineer) | JavaScript |
| expense-manager · private | Self-hosted personal finance app | TypeScript · Supabase · Vercel |
| mssp-soc-playbooks | KQL hunting queries and detection playbooks from real MSSP work | KQL · Sentinel · Defender XDR |
| sri-lanka-pdpa-awareness | Bilingual (Sinhala/English) public guide to Sri Lanka's Personal Data Protection Act No. 9 of 2022 | Legal research · Static web |
| Threat Detection & IR | EDR/XDR triage · process lineage · LOLBin analysis · KQL hunting · AiTM & token theft · BEC · containment |
| AI Security | LLM & agentic threat modelling · prompt injection · AI workload protection in Azure · OWASP LLM Top 10 · MITRE ATLAS |
| Vulnerability Management | Exposure analysis · CVE advisories · SSVC prioritisation · remediation and closure criteria |
| Identity & Access | Entra ID · Conditional Access · MFA & passwordless · Zero Trust |
| Network & Email | FortiGate & SonicWall policy · IPsec / SSL VPN · segmentation · header analysis · tenant-wide purge & hunt |
| Governance | ISO 27001 · NIST CSF · COBIT · change management · client advisories |
🛡️ SOC & Detection
-0078D4?style=flat-square&logo=microsoftazure&logoColor=white){kind=icon}
🔍 Vulnerability Management
🤖 AI & Automation
💻 Development
☁️ Identity, Cloud & Infrastructure
🌐 Network & MSP Tooling
Automating Environmental Decision Points in Stakeholder-Specific Vulnerability Categorization A Multi-Tenant Evaluation Against CVSS-Based Remediation Baselines — Executive MSc, Asia e University
CVSS base scores describe a flaw in the abstract and say nothing about whether the affected system is internet-facing, patched or business-critical. SSVC addresses that, but its environmental decision points are assigned by hand. This research tests whether those decision points can be derived from managed service provider telemetry, and backtests the result against NVD, EPSS, CISA KEV and Vulnrichment to compare exploitation coverage, efficiency and remediation effort with conventional CVSS-ranked patching.
A question raised during this research led to a merged contribution to the SSVC standard maintained by the CERT Coordination Center (Carnegie Mellon University) — the story on Medium.
Working toward
- SC-500 Exam Guide: What to Study and What It Actually Tests — 08 Nov 2026
- How a thesis question fixed the SSVC standard — 24 Oct 2026
- When Offboarding Goes Wrong: The Security Debt Nobody Talks About — 18 Aug 2026
- How I Passed the SC-100: Microsoft Cybersecurity Architect Exam — 15 Aug 2026
- BEC Is Not Just an Email Problem - It’s an Organizational Crisis — 04 Jul 2026
tharaka@soc:~$ exit · all systems secure 🟢