Security
Threat analysis · Vulnerability assessment · Network monitoring · Incident response · Security automation
Used to understand attack surfaces, validate controls, and turn findings into defensive action.
CAPABILITY MAP
01 / PRACTICE
Skills measured by application.
Not a wall of percentages. Each discipline is framed by the work it enables and the context in which I use it.
AI / ML
Python · Data preparation · Applied machine learning · RAG · Model integration
Used to build useful classification, retrieval, analysis, and workflow-assistance capabilities.
Engineering
Flask · Django · REST APIs · JavaScript · HTML/CSS · SQL
Used to deliver complete, accessible applications with clear contracts and maintainable structure.
Infrastructure
Railway · Vercel · MySQL · Supabase · GitHub · Environment configuration
Used to move systems from local development into observable, reproducible deployments.
Tools
Nmap · Wireshark · Metasploit · Burp Suite · Git · Linux
Used for investigation, testing, diagnostics, version control, and day-to-day technical operations.
02 / CAPABILITY MATRIX
Capability described by decisions and outputs.
The matrix connects an operating question to the practices used, the artifact produced, and the evidence needed before treating the work as complete.
DISCIPLINEOPERATING QUESTIONPRACTICESOUTPUT / EVIDENCE
01 / SecurityWhat can fail, be abused, or cross a trust boundary?Threat modeling · surface review · vulnerability validation · control mappingRisk record · reproducible finding · control decision · verification note
02 / AI & MLWhat decision or workflow benefits from model assistance?Data preparation · retrieval design · evaluation cases · refusal boundariesDataset contract · evaluation set · grounded output · limitation statement
03 / EngineeringWhat is the smallest reliable behavior the user needs?API contracts · state modeling · accessible interfaces · automated testsWorking slice · test evidence · error states · maintenance notes
04 / InfrastructureCan the system be released, observed, and recovered safely?Environment contracts · migrations · health checks · deployment diagnosticsRelease record · readiness signal · rollback path · configuration inventory
05 / InvestigationWhat happened, what supports that conclusion, and what remains unknown?Traffic inspection · log analysis · timeline building · hypothesis testingEvidence ledger · finding confidence · competing explanation · next collection step
03 / METHOD
From question to verified system.
A repeatable process that keeps security and user value connected.
Map
Clarify the user, assets, boundaries, dependencies, and definition of success.
Model
Choose the smallest architecture that can make behavior visible and testable.
Build
Implement in focused slices with explicit data, interface, and failure contracts.
Verify
Test behavior, accessibility, responsiveness, deployment, and operational signals.
04 / TRUST MAP
Controls connected across the system.
Security decisions become useful when they follow data and authority through the full operating path—not when they remain isolated tool results.
01IDENTITYAuthentication · roles · session boundaries
02APPLICATIONValidation · authorization · safe failure
CONTROL PATHVERIFY EVERY CROSSING
03DATAClassification · integrity · retention
04OPERATIONSSecrets · telemetry · recovery
05 / WORKING PRINCIPLES
How the tools are used matters.
Tools change quickly; the operating principles behind their use should remain inspectable.
Scope access before adding capability.
Identity, permissions, secrets, and destructive actions are bounded to the smallest useful surface.
Make degraded states diagnosable.
Validation, structured errors, health signals, and recovery notes turn failure into usable evidence.
Keep consequential decisions accountable.
Automation and AI can prepare, classify, and recommend; approval boundaries remain explicit where impact matters.
Nmap · Wireshark · Burp Suite · logs · structured inspection
Python · Flask · Django · JavaScript · SQL · REST contracts
pytest · accessibility checks · responsive checks · evidence review
Git · Linux · Railway · Vercel · environment and release diagnostics