Engineering
Sovereign
Security Systems
I design and build advanced security architectures — from AI-driven threat detection and SIEM engineering to cloud-native defense systems and automated incident response.
The Evolution of a Sovereign System
Synapse is not a single product — it is a growing security architecture that evolved from a basic detection idea into a multi-domain sovereign platform. Each phase builds on the last, reflecting expanding capabilities and depth.
The seed concept — a simple log-monitoring prototype that asked: "what if we could correlate events automatically?" Proof that the idea was worth building.
The full-scale architecture — SIEM, Kafka streaming, OpenSearch analytics, ML anomaly detection, TheHive/Cortex integration, and Zero-Trust policy enforcement. Built to be enterprise-grade from day one.
The challenge: compress the enterprise beast into a deployable containerized SOC. Processes 10,000+ events/day at ~2–3s detection latency. Full stack in Docker Compose — Wazuh, Kafka, Spark, TheHive, Cortex.
The pivot — from pure defense to active adversarial simulation. Vector models attacker TTPs, enabling red-team automation and adversarial testing integrated directly into the detection pipeline.
Operational stealth layer — protecting offensive operations through deception, obfuscation, and covert channel design. Umbra makes attack simulation invisible to detection systems not built for it.
The intelligence core — upgraded and rebuilt to integrate seamlessly across all six arms. Axiom handles policy enforcement, correlation logic, and the central decision brain of the sovereign system.
The forensics laboratory — a dedicated investigation environment for deep-dive analysis, artifact reconstruction, and timeline correlation. Small but mission-critical when incidents demand certainty.
The advanced detection and intelligence layer — Spectra enriches raw signals with behavioral intelligence, TI feeds, and multi-source correlation to transform noise into actionable sovereign intelligence.
The shield. As the architecture grew across six domains, Aegis was built to protect the internal components with advanced resilience layers, data-sovereignty controls, and national-grade defense mechanisms. The full integration of all arms — where every domain supports the others.
What I Build
Security Architecture
Designing layered defense systems across hybrid, cloud, and on-prem environments with Zero-Trust principles.
SIEM Engineering
Building, tuning, and operating Splunk, ELK, and Wazuh pipelines with ML-based alert classification.
Threat Detection & ML
Developing anomaly detection models using behavioral analytics and MITRE ATT&CK-aligned correlation logic.
Security Automation
Automating triage, enrichment, and incident response workflows to reduce analyst overhead by 40%+.
Cloud Security (AWS)
Deploying GuardDuty, WAF, IAM baselines, CloudTrail, and Security Hub for cloud-native defense postures.
Penetration Testing
Executing AD exploitation scenarios, privilege escalation, and multi-stage attack simulations for real-world validation.
Tools & Technologies
Certifications
Let's Work Together
I'm available for consulting, security architecture engagements, and technical collaborations. Share your environment, the operational problem you're facing, and your target outcome — I'll give you a direct response.
Looking for managed security for your business?
KYRIE SOC delivers enterprise-grade cybersecurity for SMBs in Jordan & UAE — automated scanning, weekly monitoring, and NCA ECC 2.0 compliance.