I build data science and ML systems end to end, then ship them. Feature engineering, calibration, validation, the unglamorous work that decides whether a model is actually useful. By day, I'm a security engineer building Python forensic automation and applied LLM workflows over high-volume operational and behavioral data.
Currently exploring: regime-aware recalibration, LLM grounding, and time-aware validation patterns for production model bundles.
|
MITRE ATT&CK triage Free-text incidents → calibrated triage cards via hybrid classifier + LLM rationale |
R² 0.615 PRA holdout Calibrated regressors, time-aware validation, regime-aware bundles (n_test 43K) |
4 pluggable backends OpenAI · Anthropic · Hugging Face · local llama.cpp — structured extraction & rationale |
|
Python · scikit-learn · sentence-transformers · Streamlit · LLMs · SQLite Free-text security incident in, MITRE ATT&CK triage card out. A TF-IDF + sentence-transformer hybrid handles the fast first pass. An LLM (OpenAI, Anthropic, Hugging Face, or local llama.cpp) commits to the verdict and writes the rationale. SQLite backs case management, bookmarks, timelines, and batch processing up to 500 rows.
|
🎯 MITRE ATT&CK-mapped output 
|
|
Python · scikit-learn · pandas · Streamlit End-to-end NBA analytics. 60+ leakage-safe features, 8 calibrated regressors, regime-aware playoff bundle swap, live odds, printable PDFs. PRA holdout → R² 0.615 · n_test 43K
|
📚 KoNotesPython · Streamlit · LLMs · NLP Local-first AI-assisted knowledge analytics. Converts Kobo and Kindle annotations into structured, queryable insight with explainable, rule-based recommendations.
|
Python · CLI Context-aware macOS trust assessment. Fast evaluation of apps, launch items, and system controls with low false-positive design. |
| ML / Modeling | scikit-learn, classification, regression, calibration, time-aware validation, residual diagnostics, threshold tuning |
| Python data stack | Python, SQL, pandas, NumPy, statistical reasoning, EDA, reproducible Jupyter workflows |
| Applied AI | LLM summarization, structured extraction, text classification, AI-assisted triage and case reporting |
| Query & detection | SQL (incl. Snowflake), KQL, Splunk SPL, query optimization, detection-as-code (Panther) |
| Security domain | telemetry analysis, forensic automation, investigation analytics, control monitoring |
| Delivery | Streamlit dashboards, Typer CLIs, joblib model artifacts, ReportLab reports, REST APIs |