I'm a final-year BCA Honours student who'd rather build cloud security than study it. The project I'm proudest of reads AWS CloudTrail logs and flags attacker activity, with every alert labelled by its MITRE ATT&CK technique. The others watch S3 for risky changes and triage SOC alerts by risk. Based in Bengaluru, India. Most of my time goes to building detection systems and working through hands-on security labs.
-
01GitHub ↗MITRE ATT&CK Cloud Detection Engine ATT&CK-MAPPED
It reads AWS CloudTrail logs, from files or live through Boto3, and flags attacker activity like logging being switched off, extra access keys added to accounts, or data moved to an outside AWS account. Every alert is labelled with its MITRE ATT&CK technique, taken from MITRE's official dataset.
- 39 rules covering 20 techniques; each rule is a small data object, so adding a detection never touches the engine
- Rules match real CloudTrail logs, not the spec: console logins are logged under signin.amazonaws.com
- Coverage page shows which cloud techniques still have no rule; 33 tests run against the real MITRE data
Python · FastAPI · Pydantic v2 · Boto3 · MITRE STIX · pytest -
02GitHub ↗CloudScanner AWS-NATIVE
An S3 security monitor. It scans every bucket in an AWS account for public access, loose ACLs or policies, cross-account access and missing Block Public Access, then alerts in real time on risky changes.
- Each finding rated Low to Critical and mapped to CIS and AWS Security Hub controls
- CloudTrail → EventBridge → Lambda pipeline catches policy, ACL and encryption changes and deletions
- SNS alert shows who made the change, from which IP, and on which bucket; 24 tests in CI
Python · FastAPI · Jinja2 · Boto3 · AWS Lambda · CloudTrail · EventBridge · SNS · Terraform -
03GitHub ↗AI-Powered SOAR Engine SOC TRIAGE
An alert-triage prototype. A Random Forest model trained on synthetic alerts scores each incoming alert from 1 to 100, and the score decides the playbook.
- Playbooks: open a ticket, notify the team on Slack, or isolate the endpoint (simulated)
- High-risk alerts posted to Slack through a webhook; every alert and action logged to SQLite
- Flask and Chart.js dashboard shows the live queue and risk trends
Python · Flask · Scikit-learn · Pandas · Chart.js · SQLite · Slack Webhooks
Security reviews for KoKoMata, a location-based mobile app where people pin photos and experiences to real places for others nearby to discover. With a fellow intern, I review the app against the OWASP Top 10 and Mobile Top 10 and co-design the fixes.
- Access control enforced with Row-Level Security, schema-isolated secrets, and SECURITY DEFINER RPCs
- Session storage secured on-device with expo-secure-store
- Reviewed OAuth sign-in, parameterised queries in privileged database functions, and HMAC-based location privacy
- Added audit logging and rate limiting to flag anomalous unlock attempts
ChandaEngine, built with three teammates in 8 days: a computational take on Chandas Shastra, the rules of Sanskrit meter. A rule-based syllabifier with consonant-cluster lookahead feeds 15+ classical meter validators. FastAPI backend, Next.js frontend, Sarvam AI for speech in and out, and 21 passing unit tests.
Netā-Nomics, a platform that makes public spending easier to follow and harder to hide. An AI pipeline uses Tesseract OCR and Google Gemini to pull government expenditure data out of unstructured PDFs, flags anomalies with multiple agents, and drafts RTI and PIL documents. Next.js, FastAPI, PostgreSQL, Docker.
Reach out if you want to talk about cloud security, detection engineering, or the work I've built.