Detection Engineering & CI/CD Pipeline
Developed and deployed SQL-based AWS CloudTrail detections in RunReveal for AWS root account activity and S3 bucket encryption modifications. Built positive and negative detection test cases and automated validation through GitHub Actions to verify detection behavior before deployment. Implemented a detections-as-code CI/CD pipeline using GitHub, protected branches, pull requests, automated validation, and token-secured deployment to RunReveal. Analyzed CloudTrail events and tuned detection logic to identify security relevant AWS configuration changes while reducing noisy service-generated activity.