Field Notes
Automation, threat intelligence, and infrastructure — some of it paid, most of it not. The same instinct runs through both: find the step that's still manual, understand why, and remove it.
Stack
Security & SOC
Platform & infra
AI & automation
Web
Selected projects
Self-hosted service mesh
SCM, CI/CD, project tracking, workflow automation, an AI gateway, and identity — a dozen-plus services behind one reverse proxy and a single sign-on layer, so nothing is logged into separately.
Solar & battery optimizer
Forecasts solar generation and household load, then decides how to dispatch a home battery, advise EV charging, and pre-cool the house ahead of demand — six phases from data pipeline to a live control loop with its own dashboard.
Household AI advisor
Watches two other automation systems, plus personal finances, and narrates what it finds — under a hard rule that the model only narrates numbers a deterministic analyzer already computed. It never does the math itself.
Comfort & air controller
Ceiling fans and whole-house ventilation, driven by live air-quality and occupancy sensors on a 15-second control loop — rules-based, not ML, on purpose.
Load forecaster
Time-series forecasting for home energy load using Amazon's Chronos-2 model, run as two small on-demand jobs rather than a persistent service.
Nothing Wilts →
A recipe site that writes itself — new dishes, weekly meal plans, and their own photography generated on a schedule, with a vision model checking its own image-generation work before anything publishes.
Lunar Outpost →
The design system behind every surface above — one signal-color pair, three surface states, and the token table each of them actually matches.
Professionally, that's leading automation and threat-intelligence platform work inside a critical-infrastructure SOC. After hours, it's a growing stack of self-hosted services doing the same thing for a house — watch, decide, act, without anyone having to remember to do it manually. The four threads below are the same work, read two ways.
At the SOC, automating phishing-ticket intake cut a 30-a-week manual queue to under 5, dropped time-to-verdict from roughly 30 hours to under a minute, and freed about 15 analyst-hours a week. Same reflex runs the recipe site below — when its AI image pipeline turned out to be silently re-running failed attempts every four hours forever, the fix was the same move: find where the loop doesn't know when to stop, and teach it.
Standing up a threat-intel platform from scratch — vendor selection through integration with 40+ feeds, up from three — was less about the tool than getting it actually used: docs, training, and wiring it into the ticketing and SIEM systems analysts already lived in. Same pattern runs the homelab: a single sign-on layer in front of a dozen-plus self-hosted apps, an AI gateway routing between local and hosted models, an image pipeline with its own QA step — nothing has to be logged into separately.
Reporting shifted from ticket-volume counts to outcomes leadership could actually act on — what risk dropped, what got faster, what capacity came back. The habit travels: when a homelab AI pipeline's bill crept up unexplained, the fix wasn't guessing, it was pulling the raw spend ledger straight out of the gateway's own database and finding the actual pattern. Full writeup →
Threat intelligence, detection, and response only work as one system if they're actually wired together — partnering with Physical Security on vendor evaluation, aligning with Engineering on OT intelligence, running joint IR exercises across teams and, once, other organizations entirely. Homelab version: a solar optimizer, an HVAC controller, and a financial advisor that share a data layer instead of pretending to be three unrelated scripts.