- CA-01Modern browser required
- CA-02Encrypted session
- CA-03Automation check
- CA-04Scope for this role
I secure identities, and the cloud they live in.
Follow one sign-in through the lab I built to prove it: a Windows workstation, a domain, a firewall, two cloud identity providers, two clouds and a SIEM. Scroll.
Checked at home first.
The request reaches DC01, the domain controller on VLAN 50. Active Directory checks the password and issues a Kerberos ticket. Nothing has left the segment yet.
Default deny.
To reach the cloud, DC01 must cross pfSense. Every interface denies by default; one written, justified rule lets this traffic out, and nothing comes back in uninvited.
Verified, then verified again.
Entra ID and Okta check the device and the second factor. No single system says yes on its own, and the providers are reached from DC01, never the other way round.
Least privilege, in the cloud too.
The same identity reaches AWS and Azure by federation, with no standing keys. Posture is scanned with Prowler and ScoutSuite, every finding mapped to CIS, NIST and PCI, and idle resources found before they cost money.
On the record.
Every step was logged. Agents on WKS01 and DC01 ship their events through the firewall to SIEM01, where Wazuh decodes each one, alerts on the few that matter, and keeps the rest.
Scanned, fixed, proved.
A credentialed scan from SCAN01 found TLS 1.0 and 1.1 still offered on WKS01. A scoped, reversible Group Policy removed them, and a third scan proved them gone.
Built, documented, proven.
Six VLANs behind one default-deny firewall, a rebuilt forest federated to two cloud identity providers, two clouds under posture scanning, a SIEM with its own rules, and every decision written down.
Enterprise IAM Lab: Hybrid Identity for a Regulated Bank
On-prem Active Directory with a tiered admin model, federated to Okta Workforce Identity and Microsoft Entra ID over SAML, OIDC and SWA, with network-aware conditional access and graduated MFA. Built to the regulatory drivers a real bank would have to satisfy, and now being rebuilt on a new forest from a written decision record.
Enterprise Security Homelab
A six-VLAN, default-deny network for a fictional regional bank: pfSense, managed switching, a Proxmox hypervisor on a trunk port, a Windows Server 2025 domain controller answering LDAPS with a certificate from the lab's own root CA, a Wazuh SIEM with five agents and its own detection rules, including thirty for an internal application's identity log, a Greenbone scanner whose identity is administrator on member machines and nothing on the domain, a first finding found, fixed and proved closed, and every firewall rule justified and mapped to a NIST control.
Cloud Security Posture Dashboard
Terraform deploys deliberately misconfigured AWS and Azure resources, Prowler and ScoutSuite scan them, and a Flask dashboard normalises 500+ checks into one findings schema with remediation commands and CIS, NIST and PCI mapping.
biirabank.com: The Public Tier
Biira Bank's public website on Cloudflare Workers: zero JavaScript, a Content Security Policy with no script source at all, TLS 1.2 as the floor, and an independent security-header grade that moved from F to A+. Testing found the site still answering on a default hostname the zone's controls did not cover, and closed it.
Collins Aerospace IT Audit: Post-Incident Assessment
A graduate IT-audit engagement on a simulated aerospace breach: COBIT-framed planning, NIST 800-30 risk assessment, CMMC Level 3 gap analysis, five headline findings and a costed remediation roadmap.
AI Agent Identity Lab: An Agent With Its Own Name
AI agents treated the way a bank treats people and service accounts: each gets its own identity, the least access that does the job, and an audit trail. Project one is an agent that answers plain questions about the lab's Wazuh SIEM under a read-only role proven by 403s, looks up machines and accounts over verified LDAPS as its own Active Directory account, and sends the model nothing that has not passed a tested secret filter.
Every event, kept.
Each host ships what it sees to SIEM01: sign-ins, file writes, policy changes, scans. Wazuh decodes every one and sorts them by how loud they are. Most are noise. Some are not. All of them are on the record.
Silence the alert, never the evidence.
A scanner signing in two thousand times looks like credential abuse. The rule was right. So a narrow rule now keeps the scanner quiet from its own address and shouts if the same account signs in from anywhere else. The events stay in the archive.
25 of them became notes.
The ones worth understanding got written up, mistakes included: the alert that cried wolf, the zone that did not exist, the scanner that is not a domain admin, the finding that was found, fixed and proved closed.
Decode me.
If a directory issued a token for me, these would be the claims: 18 credentials, weighted toward identity and cloud security, and 3 more in progress. Signed, and not expired.
Want to break something?
Three things to try before you go. They all run in your browser, and nothing you type is sent anywhere.
Someone is trying to reach Noble.
Number match: 42. Approve to open a session.
- nobleantwi3@gmail.comemail, the fastest way
- LinkedIn ↗where I post the lab notes
- GitHub ↗every repository, public
- Now pagewhat I am doing this month
Working in IT security in Chicago, and building a regulated-bank identity and network lab on the side. M.S. Cybersecurity & Digital Forensics, Illinois Institute of Technology.
Request denied. Fair. The email still works if you change your mind: nobleantwi3@gmail.com