I design and build AI-powered cybersecurity tools, autonomous defense workflows, document intelligence systems, and privacy-conscious infrastructure.
My work sits at the intersection of Sovereign AI, defensive security engineering, Zero Trust architecture, threat intelligence, and evidence-driven analysis.
- 🎓 Scholar @ IHFC — IIT Delhi
- 🧠 Focus Areas: Sovereign AI, LLM Security, Defensive Cybersecurity, and Autonomous SOC Engineering
- 🛡️ Security Philosophy: Least privilege, defense in depth, verifiable evidence, and human-supervised automation
- 💻 Development Environment: Mobile edge infrastructure using iPad Pro and iSH Alpine
- 🚀 Mission: Build accessible, modular, and transparent AI-powered defensive security tools
A growing portfolio of defensive security platforms focused on investigation, detection, risk assessment, and security operations.
| Project | Description | Technology |
|---|---|---|
| SecOps-Nexus | Unified security operations and threat intelligence hub | AI · SOC · Threat Intelligence |
| Threat-Architect | AI-assisted defensive threat modeling and MITRE ATT&CK mapping | Python · AI · MITRE ATT&CK |
| Log-Sentinel | Security log analysis, anomaly investigation, and authorization monitoring | Python · SIEM · Streamlit |
| Firmware-Guardian | Firmware and binary security inspection, secret detection, and entropy analysis | Python · Binary Analysis · Cryptography |
| Smart-Document-Detective | RAG for technical document investigation and evidence-backed analysis | Python · LangChain · ChromaDB · OpenAI |
| Project | Description | Technology |
|---|---|---|
| ZeroTrust-Shield | Network telemetry analysis, lateral movement investigation, and zero-trust policy guidance | Python · Streamlit · OpenAI |
| HoneyNode-AI | Honeypot event investigation and defensive containment recommendations | Python · Streamlit · AI |
| Sovereign-Guard | LLM security analysis for prompt injection, jailbreak attempts, and data exfiltration risks | Python · LLM Security · Streamlit |
| Cloud-Sentinel | Multi-cloud IAM and configuration risk analysis for AWS, Azure, and GCP | Python · Cloud Security · OpenAI |
Engineering principle: These applications are designed as defensive analysis and decision-support tools. AI-generated findings are recommendations, not proof of an incident or confirmation that a system has been compromised.
My broader architectural direction is to develop modular components for locally controlled, privacy-conscious, and evidence-driven AI security infrastructure.
| Module | Architectural Focus |
|---|---|
| NomaanOS-Core | Execution kernel and autonomous agent orchestration |
| NomaanOS-EvidenceLedger | Cryptographic hash-chain concepts for tamper-evident evidence records |
| NomaanOS-GhostNode | Air-gapped identity and keyed HMAC authentication concepts |
| NomaanOS-ShieldSOC | Host monitoring, security telemetry, and SOC workflows |
| NomaanOS-Production-Dashboard | Enterprise operations and SOC monitoring dashboard |
| NomaanOS-SmartDashboard | Interactive telemetry and smart SOC operations dashboard |
These names represent architectural focus areas; implementation status and capabilities should be evaluated from each repository.
- Retrieval-augmented generation (RAG) and contextual document retrieval
- Prompt injection and jailbreak risk assessment
- Defensive AI workflow design and human-supervised analysis
- Evidence-grounded reporting and uncertainty-aware recommendations
- Security information and event management (SIEM) concepts
- Network telemetry and lateral movement analysis
- Honeypot event investigation and defensive deception
- MITRE ATT&CK-aligned threat modeling
- Firmware inspection, secrets detection, and cryptographic analysis
- Identity and access management (IAM) review
- Least-privilege policy recommendations
- Cloud configuration risk assessment
- Zero Trust principles and defensive monitoring
- Linux-based development and security automation
- PDF ingestion and text extraction
- Semantic chunking and vector search
- Context-aware question answering
- Evidence citations and investigation reports
- Python
- JavaScript / TypeScript
- Shell / Linux tooling
- AI application development workflows
- Zero Trust
- MITRE ATT&CK
- NIST SP 800-53
- IAM and SIEM
- RAG Security
- Cryptographic Integrity
- Threat Modeling
Technologies listed reflect the broader project portfolio; individual repositories may use different subsets of this stack.
- Evidence before conclusions: Findings should be supported by observable evidence and clearly stated assumptions.
- Least privilege by default: Minimize unnecessary permissions, access, and execution authority.
- Defense in depth: Use layered controls rather than relying on a single security mechanism.
- Human-supervised AI: Keep security-critical decisions reviewable and subject to operator verification.
- Privacy-conscious development: Avoid exposing API keys, credentials, confidential telemetry, or sensitive document contents.
- Reproducible engineering: Favor documented setup instructions, dependency management, version control, and testable behavior.
- Honest security claims: Distinguish simulated demonstrations from validated findings and live integrations.
My ongoing engineering direction includes:
- 🔍 Improving evidence quality and explainability in AI-generated security reports
- 🧩 Developing reusable modules for defensive AI and security automation
- 📚 Strengthening RAG retrieval quality and document-grounded citations
- ☁️ Expanding cloud security analysis and least-privilege recommendations
- 🛡️ Improving LLM input-risk analysis and prompt-injection defenses
- 🔐 Exploring tamper-evident security evidence and integrity verification
- 🧪 Adding automated tests, safer configuration, and clearer deployment documentation
Roadmap items describe development goals, not necessarily implemented or released capabilities.
My projects are intended for authorized defensive security work, controlled demonstrations, security education, and investigation of systems for which appropriate permission exists.
AI-generated assessments can be incomplete or incorrect. Validate recommendations against authoritative evidence and applicable security requirements before deploying changes to production systems.
Security hygiene matters:
- Never commit API keys, passwords, access tokens, private certificates, or confidential logs to public repositories.
- Validate security findings before acting on them.
- Keep human oversight in security-critical workflows.
- Document limitations, assumptions, and testing methodology.
- 🏢 GitHub Organization/Profile: NomaanOS-Dev
- 📂 Explore the repositories to review source code, installation instructions, and current implementation status.
- ⭐ If a project is useful, consider starring the repository, reporting issues, or contributing improvements.
Designing modular AI systems where security, transparency, verifiable evidence, and operator control come first.
Built with curiosity, engineering discipline, and a defensive security mindset.