Sn0wAliceWhoami
Curiosity with a job title attached.
Detection, response and risk analysis. Plus enough dev to build my own tools instead of waiting for them.
I'm a cybersecurity engineer working where security meets fintech, with a soft spot for automating the boring parts.
Away from the alerts and dashboards, I build: small tools, automations, and the occasional overengineered side project (this very website being a solid example). I like understanding how things break, why they break, and how to catch it faster the next time around.
Fields
Three worlds, one obsession.
- 01
Cybersecurity
Detection, response and the daily blue-team grind. Keeping systems boring in the best possible way: quiet, monitored, and hard to surprise.
- 02
Fintech
Security where money moves in real time. Protecting payments, accounts and transactions when both the stakes and the speed run high.
- 03
RegTech
Turning regulation into something machines can actually enforce. Controls and audit trails that hold up when someone asks the hard questions.
mlab.sh
Not a side project. A platform.
A modular environment for threat intelligence and IOC analysis at scale. Built one module at a time, wired into one place teams can work from.
Open source
Mostly Rust, mostly for the terminal.
Notes
Write-ups and the occasional rant.
Rewriting Deluge in Rust Without Breaking a Single Client
Replacing a Python BitTorrent daemon with a Rust one, where the wire protocol is extracted from the original instead of transcribed by hand, and a container gate refuses anything that drifts.
Writing an eBPF Rootkit, Then the Detector That Kills It
Building a userland-hiding eBPF implant with aya, then flipping sides to hunt it from the kernel. Red and blue in one write-up.
Decrypting a Malware C2 Protocol From a Single PCAP
No binary, just one packet capture. Reversing a custom beacon protocol from raw hex down to plaintext commands, with a decoder in Rust.