CYBERSECURITY · INFRASTRUCTURE · CLOUD · AI-ASSISTED AUTOMATION
I'm Scott. I'm building a home Cyber Operations Center from the ground up and documenting the decisions, mistakes, troubleshooting and lessons that come with it.
ABOUT
I wanted an engineering journal and project portfolio that showed more than certifications and screenshots. Most of what you'll find here came from problems I ran into while building and securing my own environment.
I'm working toward cybersecurity and SOC-focused roles, with hands-on work across SIEM, endpoint security, networking, Linux, Windows identity, containers, automation and cloud. I'm also deliberately building toward broader security engineering, cloud security, and AI-assisted automation engineering capability through production-style projects. I don't pretend my homelab is an enterprise environment. Part of the point is learning where the differences are, and what I would do differently at scale.
FEATURED WORK
Guided Python/PowerShell analysis, case logs and reports, harmless practice, evidence handoff and controlled generated-log retention. Latest update read-back verified; 128 local tests passed.
Read the case study →Custom PowerShell automation, safe managed reporting, selective cleanup and a complete offline troubleshooting playbook, with verified release backups and UCU branding.
Read the case study →A Docker Compose media platform on Atlas v1, connecting requests, library automation, custom-format policy, subtitles, trailers and Jellyfin playback. Portable infrastructure definitions are public; application state and credentials stay in the deployment.
View the repository → Read the journal →Phase 10 has reached a validated pre-attack identity baseline: Windows Server 2025 AD DS/DNS, a Windows 11 Enterprise domain client, AGDLP-based delegated administration, separate everyday/admin/Tier-0 identities, Tier-0 workstation restrictions, advanced auditing, machine-account quota hardening and clean restore snapshots. Controlled attack, detection, investigation and remediation are next. Phase 9 Nextcloud remains complete.
View the repository →Operational private platform · public portfolio showcase published. A production-style AI automation platform with deterministic eligibility and safety gates, grounded document generation from verified data, reviewer critique, and human authority preserved at every consequential decision — not presented as fully autonomous.
View the case study →Feature-complete, operational, and maintained: real device discovery, profile-based access schedules and budgets, Pi-hole v6 group-policy enforcement, and Wazuh security alerts with MITRE ATT&CK context.
View the repository →A modular PowerShell framework for provisioning, validating, backing up, restoring, and maintaining Windows engineering workstations, with a documented and tested rollback path at every stage.
View the repository →All five AWS onboarding activities are complete: Budgets, secure EC2 lifecycle, Bedrock evaluation, Lambda web app and Aurora PostgreSQL. Family IT Help Desk v0.2 authenticated ticket management is complete, including the validated Submitted → In Progress → Resolved lifecycle.
View the repository →A self-hosted automation and intelligence platform with completed cybersecurity intelligence and certification lifecycle modules.
View the repository →The Linux Mint Cinnamon engineering workstation and primary COC control node, built with secure installation, selective restoration, endpoint monitoring and acceptance testing.
View the repository →An on-demand isolated virtual cyber range hosted on Cerberus for controlled attack simulation, Active Directory testing, hardening verification and detection engineering. Ares has no dedicated hardware and exists only when an engineering exercise needs it.
View the repository →Code and configuration will be linked here as each project reaches a state that's useful to share. Until then, the journal shows the work without pretending unfinished repos are finished projects.
SKILLS & TECHNOLOGY
These are tools and areas I'm using in the lab—not a claim that I've mastered every item.
CERTIFICATIONS
Earned certifications are shown separately from exams I'm currently pursuing, with the full page connecting credentials to related hands-on work.
Vendor-neutral cybersecurity foundations across threats, architecture, operations, identity, risk and incident response.
Valid through 2029Foundational AI, machine learning, generative AI, responsible AI and AWS AI-service knowledge.
Earned August 29, 2026A concise view of my cybersecurity training, hands-on projects, certifications, technical skills and professional experience.
View resume →ENGINEERING JOURNAL
Build decisions, failed assumptions, troubleshooting notes and the lessons worth keeping.
Automation, ownership-based cleanup, an offline playbook and the distinction between integrity checks and physical acceptance.
Read the entry →Bringing requests, library automation and playback together on Atlas—and documenting the boundaries before adding more services.
Read the entry →Delegated administration, machine-account quota hardening, Tier-0 restrictions, advanced auditing, DNS troubleshooting and the clean pre-attack baseline.
Read the entry →Turning a manual job search into a production-style AI automation platform — deterministic safety gates, grounded generation, reviewer critique, and why a security review catching my own overbroad privilege design was the best thing that happened to it.
Read the entry →Five onboarding activities became hands-on work across cost controls, EC2, Bedrock, serverless application engineering and Aurora PostgreSQL—with cleanup treated as part of the build.
Read the entry →Windows Server 2025, privilege separation, AGDLP, managed service identities and a deliberately vulnerable Kerberos attack path.
Read the entry →From secure EC2 and a human-reviewed Bedrock exercise to authenticated tickets, DynamoDB persistence and SNS email.
Read the entry →Nextcloud on Atlas, proven recovery and reboot persistence, and a clear boundary for deferred mobile onboarding.
Read the entry →How the official exam blueprint and a rough first practice result turned into a focused study plan—and a pass on the real exam.
Read the entry →How an older Dell Latitude became an operational Ubuntu server with validated unattended power and service recovery.
Read the entry →How a simple expiry reminder became a tested system for renewal rules, continuing-education progress, authenticated updates and auditable email delivery.
Read the entry →How I turned eight security feeds into one ranked daily briefing without just moving information overload into my inbox.
Read the entry →The project started smaller than this. Here's how it turned into the backbone of my cybersecurity learning.
Read the entry →What changed when I stopped collecting isolated projects and started treating the lab as one documented system.
Read the entry →The controls, compromises and validation behind the laptop, workstation, phone and tablet baseline.
Read the entry →