Security engineering — detection and response, identity, automation. Santo Domingo, Dominican Republic.

By day I run Defender XDR and Sentinel for a tenant covering several group entities and a public commercial platform: alert triage, KQL threat hunting, Conditional Access and privileged identity in Entra ID, Intune across 132 endpoints, and the policies and runbooks that have to survive an audit. Most of what is here started as something I needed at work and could not find.

I also build and operate a services marketplace in production, solo, end to end.

Security tooling fails in a specific, quiet way: it reports success without having done anything. A gate that never ran, a query that came back empty because it was denied, a scanner that skipped a directory it could not read — all of them look exactly like a clean result. So every tool in this list is built to the same three rules.

Read-only by construction, not by intention. Where a tool touches a live tenant, the read path physically cannot write — no method parameter, no body, a hardcoded verb — and a test walks the source and fails the build if that stops being true.

Three outcomes, never two. clean, finding, and I could not check. A tool that only has the first two will always disguise the third as the first, and the day it matters is the day you believe it.

A test suite is not evidence until you have watched it fail. The three newest projects ship a mutation harness you can run yourself: it breaks the code on purpose, one defect at a time, and fails if the tests stay green — or if a mutation never applied, which looks identical to a mutant that survived. Writing that harness for revtriage is how I found that its headline guarantee had been passing on two empty sets.

Every README states what the tool cannot do, in its own section. That part is not modesty. A tool that oversells its coverage is worse than no tool, because you stop looking.

Three tools, one idea: an intruder who is already inside leaves traces that a vulnerability scan will never find. Each stands alone; they share a posture, not a library.

All read-only. All run on synthetic data with zero setup, so you can see what they do before deciding whether to point one at a tenant.

• identity-blast-radius — if this one account is phished, what does the attacker reach? Roles held, roles one step away via PIM, and the path almost nobody models: permissions inherited from apps the account owns.
• entra-privilege-auditor — over-privileged and abandoned app registrations, ranked by exposure. An uncatalogued permission scores as unknown, never as harmless.
• oauth-consent-monitor — illicit consent grants. The signal is not one scope, it is the combination: offline_access plus a data scope, consented by a user rather than an admin, to an app from another tenant.
• intune-drift — diffs two Intune snapshots with a security lens. Not what changed — which change weakened the posture.
• EntraHygiene — PowerShell module, five read-only cmdlets: stale accounts, privileged accounts without strong MFA, permanent vs PIM-eligible roles, Conditional Access gaps. Outputs objects, not text.
• m365-tenant-hygiene — tenant hygiene audit over Microsoft Graph, self-contained HTML report.
• m365-command-center — one-page read-only console: failed logins, risky users, service health, mail exfiltration.

• sentinel-detection-as-code — KQL detections validated with Microsoft's own parser and mapped to ATT&CK against the official catalogue, so a technique ID cannot be invented.
• detection-coverage — coverage matrix against MITRE ATT&CK that flags phantom coverage: a rule citing a revoked or non-existent technique covers nothing, and inflating a map with dead IDs is the exact self-deception a coverage map exists to prevent.

• secret-scout — finds secrets in git history, not just the working tree. Deleting a secret and committing does not remove it. Never prints the secret; entropy-gated so people do not switch it off.
• blastradius — what breaks if you change this? Ranks files by criticality and shows which impacted files have no test.
• certadel — passive, authorized external posture assessment: TLS, headers, cookies, DNS, email auth. Inspects, never exploits.

• security-writeups — methodology and code on Microsoft security engineering. No organization-specific detail, ever.

_{Microsoft SC-500 and SC-100 in preparation · Defender XDR · Sentinel · KQL · Entra ID · Conditional Access · Intune · Purview · Microsoft Graph · PowerShell · Python}