Infrastructure, cloud, and security focused engineer building automated, observable, and secure systems across enterprise-style environments.
Hands-on experience operating workloads across AWS and Azure, primarily on RHEL-based Linux systems in cloud and on-prem style environments.
Familiar with security integrated system hardening, container vulnerability scanning, centralized detection, and structured threat hunting using DISA STIGs, Trivy, Elastic Stack, Microsoft Sentinel, KQL, and MITRE ATT&CK.
Designed and operate container workflows that automate build, scan, and promotion stages using CI/CD pipelines rather than manual deployment processes.
Additional experience includes ingesting metrics, logs, and network telemetry via SNMP and Syslog, with traffic analysis using Zeek to support troubleshooting and incident response.
Mon1theus
Centralized observability platform for a Layer 3 routed homelab using Prometheus, Loki, Grafana, and SNMP/syslog telemetry, with validated OSPF reconvergence and link-failure visibility during real failover and recovery tests.
Azure Release Verifier
Automated Azure release validation system that scales verification workloads with VM Scale Sets, checks application health post-deployment, and securely stores verification results using Managed Identity and Azure Storage
STIG-Hardened
Automated DISA STIG scanning, remediation, and validation for RHEL 9 systems using Ansible and SCC, achieving over 80% compliance with repeatable workflows
ScanOps
End-to-end container security pipeline using GitHub Actions, Trivy, and AWS ECR to enforce vulnerability gating, SBOM generation, and image promotion with automated alerts
Breach Tracker
AWS-based backend service built on ECS Fargate, internal ALB, and API Gateway to collect, process, and expose breach data using Terraform and Ansible
The Helpdesk Deception
Hypothesis-driven threat hunt analyzing misuse of helpdesk access on an intern workstation using Microsoft Sentinel and Defender for Endpoint, focusing on behavioral sequencing, interactive misuse, persistence, and narrative cover techniques rather than single-event alerts.
Tor Browser Usage Detection
Detection-focused threat hunt validating controls against anonymization tools by identifying TOR Browser artifacts, runtime processes, and outbound encrypted connections to known TOR nodes on a corporate endpoint.
- 🌐 Cloud Resume:
https://www.streetrack.org - 💼 LinkedIn:
https://www.linkedin.com/in/Thuynh808