Cloud security and identity work, mostly AWS and IAM, tools and hands-on labs built around real-world access, detection, and abuse scenarios.
pip install iamwho
Static AWS IAM attack-path analyzer. Most IAM review asks whether an action is allowed; iamwho asks what becomes reachable once an identity is compromised, who can assume it (ingress), what it unlocks (egress), and whether its permissions enable escalation or persistence (mutation).
Detection and response lab using GuardDuty findings and Lambda-based remediation.
Active Directory lab on Azure covering directory structure, group-based access, and automated user provisioning.
SIEM lab focused on log ingestion, queries, and visualization.