AI, DevSecOps & Forensic Systems Engineer | Criminal Investigation & Criminology
Building hardened forensic cryptographic engines, DevSecOps automation platforms, high-throughput SRE resilience tools, and foundation AI algorithms from scratch.
-brightgreen.svg){kind=icon}
I bridge the gap between rigorous analytical investigation (Criminal Investigation & Criminology) and hardened, low-overhead systems engineering. My work focuses on building zero-fluff, production-grade tools designed for determinism, cryptographic assurance, high throughput, and strict security compliance:
- 🔒 Forensic Cryptography & Chain of Custody: Implementing ISO/IEC 27037 standards, BLAKE3/SHA-256 Merkle trees with domain separation, memory-mapped entropy carvers, and database-level immutable DDL triggers.
- 🛡️ DevSecOps & Platform Automation: AST/regex OCI container scanning, DAG-based CI engines with process sandboxing, atomic zero-downtime symlink deployment orchestrators, and authenticated AES-256-GCM backup DR pipelines.
- 📈 Site Reliability Engineering (SRE): Multi-Window Multi-Burn-Rate alerting engines (Google SRE Workbook standard), chaos engineering with kernel safety switches, microsecond W3C distributed tracing, and procfs zero-fork monitoring.
- 🧠 AI / LLM Guardrails & Neural Internals: Deterministic prompt injection defenses, PII sanitizers, reverse-mode autograd engines, BPE tokenizers, and pure NumPy vector databases.
Every repository in my portfolio adheres strictly to an uncompromised DevSecOps Standard:
| Quality Gate | Standard & Implementation | Status |
|---|---|---|
| Test Suite | Comprehensive unit, integration, and property-based async test suites | 1,743+ Passing (100%) |
| Code Coverage | Enforced threshold via pytest-cov
|
|
| Security Auditing (SAST) | Static AST security analysis via Bandit (bandit -r . -ll) |
0 Vulnerabilities |
| Secret Scanning | Zero credential or token leakage via Gitleaks (gitleaks detect) |
0 Leaks Detected |
| Supply Chain Assurance | CycloneDX standard Software Bill of Materials in each release | 27 sbom.json Generated |
| Performance Benchmarks | Empirically verified high-throughput test runs with resultados.json
|
All SLAs Met |
| Repository | Core Value & Architecture | Tech Stack | Tests & Coverage |
|---|---|---|---|
| merkle-chain-custody | ISO/IEC 27037 forensic chain of custody with dual streaming hashing (BLAKE3/SHA-256), balanced Merkle trees, and SQLite immutable DDL triggers | Python 3.10+, BLAKE3, SQLite Triggers, HMAC, Pydantic v2 |
84 passing (96.4%) |
| threat-log-detector | High-throughput unsupervised log anomaly detector using Isolation Forest + Mahalanobis distance with zero-pickle safe serialization | Python 3.10+, Scikit-Learn, NumPy, Pydantic v2 |
59 passing (93.0%) |
| forensic-timeline-reconstructor | Multi-source forensic timeline correlator and timestomping detector with bounded |
Python 3.10+, Heapq, Asyncio, Pydantic v2 |
46 passing (93.3%) |
| entropy-file-carver | High-speed raw binary carver using Shannon entropy sliding windows, memory-mapping, and active anti-ZipBomb (CWE-409) mitigations | Python 3.10+, Mmap, Math, Pydantic v2 |
96 passing (94.1%) |
| crime-network-analyzer | Financial crime and AML fraud network engine with directed/bipartite graphs, PageRank, Louvain communities, and |
Python 3.10+, NetworkX, Louvain, GEXF/Gephi |
47 passing (94.7%) |
| Repository | Core Value & Architecture | Tech Stack | Tests & Coverage |
|---|---|---|---|
| container-secret-scanner | Streaming AST and regex secret scanner for OCI container images with Shannon entropy, Tar Slip defense (CWE-22), and SARIF v2.1 export | Python 3.10+, AST, Tarfile, SARIF v2.1 |
121 passing (93.5%) |
| lightweight-ci-runner | Zero-dependency DAG CI execution engine with 3-color cycle detection, isolated process sandboxing, and JUnit XML reporting | Python 3.10+, Subprocess Sandbox, DAG, JUnit |
78 passing (93.8%) |
| linux-sre-watchdog | Zero-fork Linux procfs SRE watchdog daemon with anti-flapping circuit breaker and privileged remediation separation (CPU |
Python 3.10+, Procfs, Signals, Circuit Breaker |
77 passing (93.7%) |
| reverse-proxy-limiter | Asyncio Layer-7 reverse proxy with distributed Token Bucket rate limiting, Circuit Breaker, and OpenMetrics export (5,096 req/s) | Python 3.10+, Asyncio, Token Bucket, OpenMetrics |
62 passing (92.6%) |
| infra-drift-detector | Deterministic 100% read-only GitOps infrastructure drift detector with unified diffs (218,000 resources/s evaluated) | Python 3.10+, GitOps Parser, Unified Diff |
84 passing (91.4%) |
| blue-green-deployer | Zero-downtime Linux deployment orchestrator with atomic symlink switching (fcntl locks, and rollback |
Python 3.10+, Linux Symlinks, Fcntl Locks |
65 passing (93.4%) |
| encrypted-backup-orchestrator | Disaster recovery orchestrator with Zstd compression (617 MB/s), AES-256-GCM encryption (275 MB/s), GFS rotation, and sandbox restore | Python 3.10+, Cryptography, Zstd, Dedup Sharding |
51 passing (95.1%) |
| stream-log-aggregator | Async multi-channel log ingestion daemon (TCP/UDP/Unix/Tail) with Grok parsing, PII sanitization, and persistent disk FIFO buffer (6,297 ev/s) | Python 3.10+, Asyncio, Grok, Disk Spool FIFO |
77 passing (90.2%) |
| prometheus-metrics-exporter | Zero-dependency Linux procfs OpenMetrics 1.0 metrics exporter with YAML alert rule engine and temporal debounce | Python 3.10+, OpenMetrics 1.0, YAML Rules |
67 passing (93.2%) |
| linux-cis-hardener | Automated CIS Benchmark Level 1 Linux hardening and auditing engine (7,901 rules/s) with unprivileged dry-run and .bak rollback |
Python 3.10+, Sysctl, SSHd, Auditd Rules |
50 passing (94.1%) |
| Repository | Core Value & Architecture | Tech Stack | Tests & Coverage |
|---|---|---|---|
| chaos-fault-injector | Linux chaos engineering tool with netem packet corruption, CPU stress, process killer whitelist, 30s dead-man switch, and LIFO rollback |
Python 3.10+, Netem / TC, Dead-Man Timer |
75 passing (96.0%) |
| slo-burnrate-engine | Multi-Window Multi-Burn-Rate alerting engine implementing Google SRE Workbook Table 5-8 with time-to-exhaustion forecasting (10,154 evals/s) | Python 3.10+, SRE Math, Time Series, Alerts |
62 passing (95.5%) |
| postmortem-incident-generator | Google SRE blameless postmortem generator with automated MTTA/MTTR/TTD metrics, forensic timeline, and validated Markdown export | Python 3.10+, SQLite, Pydantic v2, Google SRE |
72 passing (95.7%) |
| distributed-tracing-profiler | Ultra-low-overhead ( |
Python 3.10+, W3C TraceContext, Contextvars |
74 passing (96.6%) |
| synthetic-blackbox-prober | Multi-phase synthetic blackbox prober (DNS, TCP, TLS, TTFB) with automated TLS certificate expiration monitoring (1,778 probes/s) | Python 3.10+, Asyncio, TLS Socket, DNS Resolver |
64 passing (94.4%) |
| Repository | Core Value & Architecture | Tech Stack | Tests & Coverage |
|---|---|---|---|
| text-to-sql-forensic-agent | Deterministic Text-to-SQL agent with AST security guardrails for police narratives and crime analysis | Python 3.10+, SQLite, AST Guardrails, Pydantic v2 |
40 passing (93.0%) |
| guardrails-engine | Ultra-lightweight self-healing structured output, prompt injection defense, and schema enforcement engine for LLMs | Python 3.10+, Pydantic v2, HTTPX |
55 passing (94.5%) |
| numpy-vectordb | Hardened BLAS-accelerated vector database in pure NumPy ( |
Python 3.10+, NumPy 2.x, BLAS, IVF Index |
52 passing (94.2%) |
| bpe-tokenizer | Byte Pair Encoding tokenizer from scratch (GPT-4 style) with streaming UTF-8 and ReDoS resistance | Python 3.10+, Regex, Streaming UTF-8 |
45 passing (94.0%) |
| minhash-dedup | 64-bit Mersenne prime MinHash & LSH pipeline for high-scale pre-training dataset deduplication | Python 3.10+, NumPy 2.x, LSH Sharding |
42 passing (93.8%) |
| nano-transformer | Autoregressive Pre-LN Transformer language model (~0.84M params) with Multi-Head Attention and causal masking | PyTorch 2.x / NumPy, AdamW |
48 passing (93.5%) |
| autograd-engine | Reverse-mode automatic differentiation engine with dynamic DAG and neural network primitives | Pure Python (Zero Third-Party Deps) |
50 passing (95.0%) |
- Languages & Core Runtime: Python 3.10+ (Pydantic v2, MyPy Strict, Pytest, Asyncio), SQL (PostgreSQL, SQLite), Bash / POSIX Shell
- Security & Compliance: ISO/IEC 27037, CIS Benchmark Level 1, CWE-400 / 502 / 208 / 798 / 409 Mitigations, Bandit SAST, Gitleaks Secret Auditing, CycloneDX SBOM
- Reliability & Observability: Google SRE Error Budgeting (Multi-Burn-Rate), OpenMetrics 1.0, W3C TraceContext, Chaos Engineering (Linux
tc/netem), Linux Procfs Daemon Design - AI & Systems Architecture: LLM Guardrails (Anti-Prompt-Injection, AST Verification), Transformer Mechanics (Pre-LN, Multi-Head Attention), Byte-Pair Encoding (BPE), Vector Indexing (Cosine/IVF), MinHash/LSH
- GitHub: @cibi-dev
- Availability: Open to full-time remote roles in AI Engineering, DevSecOps, Platform Engineering & SRE / Forensic Systems.