Cisco Certified in Cybersecurity
Foundational security operations credential: threats, vulnerabilities, network defense, and incident handling.
THREAT ANALYSIS · CISCO CERTIFIED · (ISC)² CANDIDATE · BTJA
SERGIO
RODRIGUEZ
I build the tools defenders actually use: exposure assessment, STIG-style compliance auditing, and threat-intel pipelines mapped to NIST 800-53 and MITRE ATT&CK. B.S. Cybersecurity (Security Threat & Analysis), Iona University. End goal: taking cybercrime off the board.
- Base
- Fishkill, NY
- Focus
- Threat analysis · Blue team ops
- Clearance to hire
- Immediate
This terminal is real. Try help, trace, scan, mission, or hire. Tab completes.
LIVE THREAT FEED
YOUR CONNECTION
read live, server-side · never stored · this is what every site you visit can see
Who is on this file
I'm a threat analyst and security toolsmith from New York's Hudson Valley, starting my B.S. in Cybersecurity at Iona University this fall with a concentration in Security Threat & Analysis. I didn't wait for the degree to start building: the tooling on this page already exists, runs, and is documented.
My foundation is defensive: Cisco's cybersecurity certification, official (ISC)² Candidate status, and the complete BTJA blue-team pathway. On top of that I've stacked serious applied-AI training, Anthropic certifications covering the Claude API, Model Context Protocol, agent architectures, and enterprise deployment on AWS Bedrock and Google Cloud Vertex AI. That combination is why I can ship tools at this pace.
Outside the SOC, I compete internationally on the Great Highland Bagpipe: 1st place, North American Championship (Youth, 2025) and 8th at the World Championship in Glasgow (2024). Ten years of competition taught me what incident response also demands: disciplined practice and precision when it counts.
SubjectRodriguez, Sergio W.
RoleThreat Analyst · Security Toolsmith
EducationB.S. Cybersecurity, Iona University (from Fall 2026)
ConcentrationSecurity Threat & Analysis
LocationFishkill, NY · Hudson Valley / NYC metro
DispositionOperational · accepting Summer 2027 assignments
30Verified certificates
7Shipped projects
6Security tools built
1stN. American champion
Certifications on record
Every certificate below is verifiable: core credentials via Credly, Anthropic certificates as signed PDFs you can open right here.
(ISC)² Candidate
Official candidate status with the organization behind the CISSP and CC certifications.
Blue Team Junior Analyst
Complete BTJA pathway: SOC fundamentals, log analysis, network traffic analysis, and defensive operations. Certificate (PDF) ↗
Security Blue Team: analyst courses
9 course certificates · click any to open the PDFAnthropic: Claude & agentic AI
13 signed certificates · click any to open the PDFBuilding with the Claude API
PDF ↗Claude Platform 101
PDF ↗Claude Code in Action
PDF ↗Claude Code 101
PDF ↗Claude in Amazon Bedrock
PDF ↗Claude with Google Cloud Vertex AI
PDF ↗Intro to Model Context Protocol
PDF ↗MCP: Advanced Topics
PDF ↗Introduction to Agent Skills
PDF ↗Introduction to Subagents
PDF ↗Introduction to Claude Cowork
PDF ↗AI Fluency: Framework & Foundations
PDF ↗AI Capabilities
PDF ↗AI Fluency: specialized tracks
5 signed certificatesInstruments built for defenders
Custom assessment tooling, packaged together as the Security Audit & Verification Suite on GitHub.
ArmSky · PolicyScout
FLAGSHIP · GOV NLPGAMECHANGER-inspired semantic search + cited QA over DoD policy
- Hybrid sparse-BM25 + TF-IDF retrieval, RRF fusion, MMR diversification
- Cross-encoder-shaped reranker that lifted citation precision 0.94 → 1.00
- Grounded LLM composer seam wired for Azure OpenAI Gov (IL5 deploy plan)
- nDCG + citation-precision CI gates · Prometheus metrics · adversarial critique log
Built against the CDAO analytic-tools ecosystem (GAMECHANGER, Advana, JATIC). Every version ships an adversarial self-critique: assume it's broken until proven otherwise.
Detect Lab
FLAGSHIP · ATT&CKA testable detection engine: Sigma-style rules over event logs, mapped to MITRE ATT&CK
- Six ATT&CK techniques: encoded PowerShell, certutil transfer, defense evasion, discovery, brute force, C2 beaconing
- Stateful sliding-window aggregation (brute force / beaconing) + stateless signatures
- Precision/recall/F1 eval harness, gated in CI: a rule that flags
docker run -p 8080fails the build - Honest v0.1→v0.2 critique log: caught a real false positive (0.82 → 1.00 precision) and fixed it
Detection engineering treated like code: rules with tests and a measurable quality bar. Because a rule that cries wolf is worse than no rule.
RangeCheck
RECON / EXPOSUREAuthorized network exposure assessment
- Async service discovery engine
- Lightweight service fingerprinting
- YAML-based finding classification with CVSS v3.1 metadata
- HTML, JSON, and CSV reporting
ControlTrace
COMPLIANCELocal baseline & compliance auditor
- DISA STIG-style check definitions
- Automated evidence collection
- Maps controls to NIST SP 800-53 & MITRE ATT&CK
- HTML, JSON, CSV, and POA&M reports
Tracer
THREAT INTELThreat intelligence pipeline
- Multi-source feed ingestion & IOC enrichment
- Elasticsearch search integration
- Neo4j graph correlation engine
- Flask REST API for analyst queries
dash
SOC OPSThreat-intel operations platform
- Feed ingestion & alert enrichment workflows
- Indicator correlation engine
- Analyst-facing API and dashboard views
Where my tooling touches the matrix
Techniques my tooling detects, audits against, or enriches; hover any lit cell. Honest coverage, not a checkbox wall. An analyst who maps his own work to ATT&CK is an analyst who understands the framework.
RangeCheck · exposure
ControlTrace · hardening
Tracer / dash · intel & detection
Real threats, pulled live right now
Not a simulation. This board fetches current threat data on the edge from CISA and abuse.ch, the same feeds a working SOC uses. It refreshes every 30 minutes.
Connecting to live feeds…
Recently weaponized
CISA KEVLoading current CVEs…
Active botnet C2
Feodo TrackerLoading live C2 servers…
Fresh indicators
ThreatFoxLoading recent IOCs…
Before it hits the KEV catalog
CISA KEV lists what's already weaponized. This board looks one step upstream: the newest CVEs from NVD, scored by EPSS — the probability a flaw gets exploited within 30 days — and filtered to the ones not yet in KEV. High EPSS + high CVSS + no KEV listing is the patch-it-now quadrant. Live, sourced, refreshed every 30 minutes.
Connecting to NVD + EPSS…
·CVEs published (7d)
·CVSS ≥ 9.0, not in KEV
·total KEV entries
Ranking newest CVEs by exploitation probability…
Ranking = EPSS probability first, then CVSS severity, then recency. EPSS via FIRST.org; scores shift daily as exploitation signal accrues. This is public-data analysis, not a claim of private discovery.
How long you actually have
Exploit search engines answer “does an exploit exist for this CVE?” — a question whose answer is eventually always yes, which makes it useless for ordering a patch queue. The question that does reorder one is how long after disclosure exploitation actually begins. This board measures exactly that, across the entire CISA KEV corpus: KEV dateAdded − NVD published, for every catalogued vulnerability. Both sources are authoritative, so every figure here is independently reproducible.
Correlating KEV against NVD…
·median days to exploitation
·weaponized within 7 days
·exploited at or before disclosure
·CVEs measured, 2023 onward
The window closing
median days, by KEV yearLoading…
Runway by vendor
2023+, shortest firstLoading…
Zero runway — exploited on or before the day they became public
METHOD & LIMITS
CISA seeded KEV in November 2021 with a large historical backfill, so 2021–2022 entries measure cataloguing latency, not weaponization speed — their medians run to years and pooling them would be a measurement error. Every headline figure above is computed on the 2023-onward subset; the chart shows all years so you can see the break for yourself. Two further limits, stated rather than buried: dateAdded records when CISA confirmed exploitation, which lags first exploitation by an unknown margin, so these are an upper bound — the real runway is shorter, never longer. And KEV is a selected sample of what CISA tracks for federal risk, not a census of everything exploited in the wild.
Reading the leak sites
Ransomware crews run victim-shaming portals as Tor hidden services. Organizations get posted there hours to days before any press coverage — which makes leak-site monitoring one of the earliest public signals in all of threat intelligence. This board reduces that feed to what actually matters: which crews are operating, at what tempo, and who they're selecting. Aggregated via ransomware.live.
Connecting to DLS aggregator…
·recent DLS postings
·distinct crews active
share held by top 5
Operator tempo
postings per crewLoading…
Sector selection
who they're pickingLoading…
Geography
victim countryLoading…
COLLECTION ETHICS
This board shows aggregate counts only. I deliberately withhold victim organization names and every .onion address, and the endpoint never emits them to the browser. Victims of extortion are crime victims — republishing their names adds pressure and produces no analytic value that the trend data doesn't already carry. Naming targets is what the crews want; counting them is what defenders need.
How they get in, and what catches them
You cannot defend a technique you don't understand offensively. Each card below is a tradecraft pattern dominating 2026 intrusions, paired with the telemetry that actually detects it. No exploit code — the deliverable of red-team knowledge on a blue team is detection logic.
T1078
Valid accounts · the malware-free intrusion
TRADECRAFT
The dominant modern intrusion drops no payload at all. Operators buy or phish credentials, authenticate through the front door, and inherit the user's trust. CrowdStrike put 82% of 2025 detections in the malware-free category. There is no hash to blocklist and no file to quarantine.
DETECTION
Identity telemetry becomes the primary sensor. Alert on first-seen ASN or device for a principal, impossible-travel deltas, interactive logon by a service account, and MFA-fatigue push patterns. The signal is deviation from that identity's baseline, not badness in a file.
T1218
Living off the land · signed binary proxy
TRADECRAFT
Execution is proxied through Microsoft-signed binaries already present and trusted: rundll32, regsvr32, mshta, certutil, msbuild. Blocklisting them breaks Windows, so they survive allowlisting by construction.
DETECTION
Baseline legitimate parent-child lineage, then alert on the anomaly: rundll32 with no command line, Office spawning a script host, certutil invoked with -urlcache or -decode. My Detect Lab ships a tested rule for exactly this certutil transfer pattern, gated in CI against false positives.
T1562
Blinding the sensor · telemetry tampering
TRADECRAFT
Before acting, capable operators degrade visibility: patching ETW providers in-process, removing userland hooks, or stopping the agent outright. The intrusion continues in a gap where nothing is being written down.
DETECTION
Monitor telemetry integrity, and treat absence of signal as signal. A host that stops heartbeating, an ETW provider that goes quiet, or a sensor version that silently rolls back should page someone. Enable tamper protection so the disable attempt itself is the alert.
T1190
Edge devices · the appliance blind spot
TRADECRAFT
VPN concentrators, firewalls, and file-transfer appliances sit internet-facing and cannot run an EDR agent. Crews operationalize n-days within days of disclosure and land in the one place the security stack cannot see.
DETECTION
Ship appliance syslog to the SIEM as a first-class source, diff running configs on a schedule, and alert on any outbound session originating from a management plane that should only ever receive. My Emerging Exposure board exists to shorten the window on exactly this class of CVE.
T1497
Sandbox evasion · detonating only for real targets
TRADECRAFT
Sandbox and VM evasion was 2026's fastest-growing technique, climbing to the top five. Payloads fingerprint the host — domain membership, uptime, user artifacts, CPU count — and simply exit clean inside analysis environments.
DETECTION
Detonate in environments with realistic decoy artifacts and aged profiles, and extend observation past timer-based delays. Treat early clean exit as suspicious in itself: a sample that checks the environment and quits has told you something about its intent.
T1567
Exfil-only extortion · skipping encryption
TRADECRAFT
Encryption for impact (T1486) fell roughly 38% relative in 2026. Crews increasingly steal and threaten without ever encrypting: it is quieter, keeps the host alive for continued access, and still monetizes. The leak-site tempo on the board above is this shift, measured.
DETECTION
The detonation-time trigger never fires, so detection moves left to data movement. Baseline egress volume per host and per identity, alert on archive utilities and rclone-class transfer tooling, and watch for bulk reads against file shares that a given account has never touched before.
Technique IDs are MITRE ATT&CK Enterprise. Prevalence figures reflect published 2025–2026 industry telemetry from CrowdStrike, Red Canary, and Picus; they are cited as reported, not independently measured by me.
Infrastructure I build to break and defend
Reading about SIEM, Active Directory, and mail security isn't the same as running them. These are infrastructure-as-code labs I stand up, attack, and then hunt in the logs — the full detection loop on infrastructure I control. Everything here is real, runnable code; each card links the build you can clone and run yourself.
SIEM Detection Lab
SIEM · ELKElasticsearch + Kibana + Filebeat, with detections as code
- Single-node ELK stack via Docker Compose — collect, ship, index, detect, alert
- Seeded attack story: brute-force burst (T1110) then a valid-account success (T1078)
- Detection engine in Python: rules are readable JSON → Elasticsearch aggregations → alerts
- Every rule mapped honestly to the ATT&CK technique it actually catches
The point isn't a dashboard — it's the analyst loop end to end, on infrastructure I own and can rebuild in minutes.
Active Directory Lab
AD · ATT&CKA domain you provision from code, attack, then catch in the logs
- Vagrant + PowerShell: Server 2022 DC (
lab.local) and a domain-joined Win10 workstation - Audit policy tuned so the right Event IDs actually fire (4624/4625, 4769, 5136)
- Attack-and-detect exercises: Kerberoasting (T1558.003) and password spray (T1110)
- Each exercise pairs the attack with the exact Windows telemetry and detection query
You can't reliably detect what you've never watched happen. This lab is where I watch it happen — inside my own domain, on accounts built for the purpose.
Mail / Exchange Lab
EMAIL DEFENSESelf-hosted mail stack for phishing and header analysis
- Full SMTP/IMAP + webmail + anti-spam stack (Mailu) via Docker Compose
- Practice SPF / DKIM / DMARC pass-and-fail, and watch DMARC stop a spoof
Received:-chain andAuthentication-Resultstriage — the core of phishing analysis- Documented path to a full Windows Server + Exchange eval build for the name-brand version
Real Exchange needs Windows Server and licensing; this teaches the same defensive surface on a laptop, with the Exchange upgrade path written down.
CI/CD Security Gates
DEVSECOPSPipelines that fail the build on a security regression
- GitLab CI on CivicPulse: SAST and secret detection gate every merge
- Detect Lab: detection rules ship with tests, gated in CI against false positives
- Security treated as a build stage, not a manual afterthought
- Same discipline applied to this site: it patches on
git push
Not a lab I spun up for show — this is how the projects in FILE 06 are actually built. The evidence is in the pipelines.
Original analysis, and how I disclose
Threat-intelligence work I measured myself, with the collection method published so you can reproduce or dispute it, alongside the coordinated-disclosure process I hold myself to.
WRITEUP 001 · PRIMARY MEASUREMENT
26 crews, five days: the infostealer-to-extortion pipeline
I pulled the 100 most recent ransomware leak-site postings and counted what was in them. Five crews held 56% of activity, and 58% carried infostealer linkage — evidence that most extortion now starts with bought credentials, not exploited software. Includes stated collection limits and the SOC detection response.
Read the analysis ↗ POLICYVulnerability disclosure
My VDP for anyone testing this site, and the five-step process I follow when I find something in someone else's: authorization first, minimum necessary proof, private report, coordinated timeline, publish after the fix.
Read the policy ↗
COORDINATED DISCLOSURES
None published yet
When authorized research of mine results in a CVE, the advisory and vendor acknowledgment get listed here. Until then this stays empty on purpose. I'd rather show you a blank slot than pad it.
Shipped demos you can click right now
Every card below is a working deployment or a live GitHub repo, not mockups. Open a demo in the theater or jump straight to source.
GitHub activity feed
Syncing repos…
Built, deployed, documented
VaultForge
CryptographyLocal-first password manager: AES-256 encryption, secure authentication, cryptographically strong generation, zero cloud dependency by design.
- Python
- AES-256
- Local-first
LicenseLoop
Full stackLicense & permit tracker with automated email reminders at 30/7/1 days before expiry. User auth, tiered free/pro plans, Stripe billing, cron-secured task endpoints.
- FastAPI
- SQLModel
- Docker
- Stripe
CivicPulse
Data / DevSecOpsOpen-government dashboard on U.S. Census ACS data. Async httpx ingestion, TTL caching, Chart.js visualization, WCAG-conscious accessibility, with GitLab CI enforcing SAST and secret detection before every merge.
- FastAPI
- httpx
- Chart.js
- GitLab CI
This portfolio
ServerlessHand-built with vanilla HTML/CSS/JS on Cloudflare Pages, live threat-feed ticker and AI assistant run as serverless Pages Functions, shipped with hardened security headers.
- Cloudflare Pages
- Pages Functions
- Vanilla JS
NovaMind AI
AI productAI business-assistant landing page with a live Workers AI demo and contact capture through Cloudflare Pages Functions.
- Workers AI
- Pages Functions
FlowForge
SaaS landingDental-practice automation landing page: ROI calculator, workflow template previews, and lead capture, optimized for Cloudflare Pages.
- JavaScript
- Cloudflare Pages
Cheat Sheet Downloader
AutomationPython scraper that extracts structured reference material and generates clean, formatted PDF cheat sheets.
- Python
- BeautifulSoup
Experience, service & honors
2023, PRESENT
Competitive Bagpiper, Capital Youth District Pipe Band
1st place, North American Championship (Youth, Aug 2025). 8th place, World Championship, Glasgow (Aug 2024). Multiple piping scholarships, 2023–2026.
NOV 2024, JAN 2025
Sales Associate, Kohl's, Wappingers Falls NY
Customer service, transactions, and holiday-rush operations in a high-volume retail environment.
SUMMER 2024
Volunteer, Dutchess Outreach & Loan Closet
Meal service for food-insecure neighbors; assisted elderly clients with medical equipment rentals at Poughkeepsie Reformed Church.
MAY, SEP 2023
Park Attendant, Splashdown Beach, Fishkill NY
Guest safety and high-volume operations during peak summer season.
Honors & scholarships
- 1st North American Bagpiping Championship, Youth Division, 2025
- 8th World Bagpiping Championship, Glasgow, 2024
- $23k Iona University Merit Scholarship
- $5k Monmouth College, highest bagpipe scholarship (recommended)
- AWD Iona Spirit & Performing Arts Award · Alumni Award · Gael Service Award
- SCH St. Andrew's Society of Schenectady (2024, 2025) · Invermark (2023, 2026) · Balmoral (2024, 2025) · GlasgowLands
Where this is headed
Hover (or tab to) any redaction to declassify.
PRIMARY OBJECTIVE: Take cybercrime off the board, ransomware crews, fraud networks, and the infrastructure they run on.
THEATER OF INTEREST: Overseas operations, Middle East posting, where cyber and national security intersect hardest.
TARGET TRACKS: FBI Cyber Division, Honors Internship · NSA student programs & Codebreaker Challenge · CIA digital-targeting pathways · CISA / DHS cyber.
CURRENT PHASE: Building the record that opens those doors, verified certifications, shipped defensive tooling, a Security Threat & Analysis degree, and the public body of work you're reading right now.
— RODRIGUEZ, S.W. APPROVED FOR RELEASE
MISSION STATUSACTIVE
NEXT MILESTONESecurity internship · Summer 2027
DEGREE TRACKB.S. Cybersecurity, Threat & Analysis
DISCIPLINE PROOFInternational championship competitor
Open a channel
Security roles, collaborations, or hard questions. I respond fast.
Email, primary
sergio.w.rdz@gmail.com
Email, university
srodriguez46@gaels.iona.edu
LinkedIn
sergio-rodriguez-453551275
GitHub
SSH-PuR66
Credly
Verified credentials
Hack The Box
Active profile
Writing
dev.to/pur63
SR-Assist
An AI briefed on this dossier. Ask it anything about my skills, tools, or availability.
Channel open. Ask me about Sergio's certifications, security tooling, projects, or how to hire him.