Open to entry-level security and AI roles from January 2027

Aman Agarwal

I build security controls and AI-powered tools, test them against real systems, and publish what failed alongside what passed.

My two security projects work as a pair. AccessOps ends a departing employee’s access in Keycloak, a Microsoft Entra test tenant and an AD-compatible directory; SignalBridge opens a case if the account is used anyway. I also built Downfield, an AI research agent that publishes checked, versioned reports to a live web app. Before that, I automated identity-alert triage in Cortex XSIAM as a cybersecurity intern at HNI.

See the work
SignalBridge evidence viewer: recorded Wazuh runs from an isolated local lab with synthetic data.
AccessOps public demo with synthetic data: open departures, the 4-hour target and the next step for each case.

AccessOpsHR departure → access ended → every system read back

SignalBridgeSign-in after departure → critical case

Selected work

Selected work, tested against real systems.

Every number comes from a dated test run, and each case study links the runs, including the ones that failed.

AccessOps public demo with synthetic data: a departure case, its next step and the evidence source of each required action.
  • Public demo
  • Public source
  • Signed release

01Identity & access management · Leaver automation

AccessOps

Disabled isn’t done.

When someone leaves, an HR event shuts off their access in Microsoft Entra ID, Keycloak and an Active Directory-compatible directory, and each system is checked to confirm the change. Anything it can’t reach stays open with an owner until someone else reviews and closes the case.

  • 2.6 sfrom the HR event to the person signed out and their tokens blocked
  • 6gaps found by live testing, each fixed or documented
  • 20 sfor Microsoft Entra ID to confirm the change, in a test tenant
  • Python
  • Django
  • PostgreSQL
  • React
  • Keycloak
  • Microsoft Entra ID
  • OPA
Read the case study Live demo Source
SignalBridge evidence viewer: recorded Wazuh runs from an isolated local lab with synthetic data.
  • Public source
  • Signed release
  • Isolated local lab

02Security operations · Detection engineering

SignalBridge

Catch the access that should have ended.

A detection lab that catches access that should have ended. Five detection rules, also written as Sigma, SPL and KQL, run against signed app events, and each finding goes through analyst review to a verified fix. It also receives AccessOps’ leaver events and opens a critical case if a departed account signs in.

  • 4writes a removed user could still make, until I found and fixed the race
  • 5detection rules, also written as Sigma, SPL and KQL and run in real query engines
  • 0events lost or duplicated when I stopped the Wazuh collector mid-run
  • Python
  • Django
  • PostgreSQL
  • Docker
  • Wazuh
  • Keycloak
  • Sigma
  • OWASP ZAP
Read the case study Source

How the two connect

When access should end, prove it did.

AccessOps offboards a departing employee and signs an event for each step. SignalBridge verifies those events and opens a case if the person’s account is used anyway.

AccessOps receives a signed HR departure, contains access and watches the account's sign-ins for a day. It sends signed Shared Signals events for containment and for any sign-in after departure. SignalBridge verifies and stores each event once, opens a critical case for use after departure, and an analyst reviews it. AccessOps · offboarding HR departure signed webhook Contain access disable, sign out Watch sign-ins for a day after SignalBridge · detection Verify, store ES256, stored once Critical case use after departure Analyst review assign, investigate Signed Shared Signals events (CAEP, RISC)
  • 32 sto catch a sign-in after someone has left and alert the security team
  • 38signed leaver events SignalBridge verified and stored in two live rounds, none refused
  • 1critical case, opened when a contained test account was re-enabled and used

Local labs with synthetic accounts, October 2026. How SignalBridge receives the events · Signal contract

More projects

Two deployed web apps and an AI research agent that publishes to one of them.

BetTail public landing page. Product previews use illustrative sample data.

03Full-stack web app · Live

BetTail

A shared record for private sports-pick groups.

Members post picks, follow them with their own stakes and see profit, ROI and leaderboards calculated in the database. Every request runs as the signed-in user under row-level security.

  • Liveprivate groups track picks, results and leaderboards
  • 6issues found and fixed in my security review

Next.js · TypeScript · PostgreSQL · Supabase

Case study Live site
Netted public sample workspace. Financial records shown here are fictional.

04Personal finance · Beta

Netted

A spreadsheet’s rules turned into an app.

A personal-finance app for trade profit, shared funds and budgeting. I wrote the accounting rules before any code, enforced MFA inside the database, and wrote a risk register for non-technical decision makers.

  • 7risks in my register, each with an owner, a fix and a due date
  • 506journal records restored from an encrypted backup, all hash-matched

Next.js · TypeScript · PostgreSQL · Supabase

Case study Product site

05Applied AI · LLM agent

Downfield

An AI research agent with guardrails.

A local AI agent that turns game, injury, news and weather data into structured NFL reports for BetTail. It runs with two tools and no app secrets, and code checks every report before it’s published.

  • 32 gamescovered across two NFL weeks, with 415 saved reports
  • Every reportchecked for schema and arithmetic before it’s published

Node.js · JSON Schema · Claude

Case study BetTail integration

Project index and code excerpts AccessOps and SignalBridge are fully public; the others publish selected code and tests.

Findings

What testing caught.

Some of the most useful results were failures. Each one below was caught by a test, fixed, and now has a test that proves the fix.

AccessOpsIdentity

Disabled, but still signed in

Found
After the account was disabled, the person stayed signed in to the app and Keycloak kept their session.
Fixed
Offboarding now ends every Keycloak session and sends a back-channel logout; the step only counts once no session is left.
Proof
22 before-and-after session and token checks, from refresh tokens to a token the app checks itself.

Verification ledger All six gaps

SignalBridgeAuthorization

Writes accepted after access was removed

Found
A user just removed from a workspace could still complete 4 case writes through a time-of-check to time-of-use gap.
Fixed
The account and role are re-checked inside the database transaction, before the record is locked.
Proof
13 regression tests covering revoked access, disabled accounts and workspace changes.

Fix Tests Before and after

SignalBridgeDetection

A detection query Splunk refused

Found
pySigma compiled one of my rules into a Splunk query that looked fine, but Splunk refused to run it.
Fixed
I hand-wrote that rule’s SPL with rolling windows and labeled which queries are generated and which are hand-written.
Proof
All five rules run in Splunk Free and a Kusto emulator against the same 48 scenarios.

Engine results Detection as code

SignalBridgeIdentity

The security policy blocked sign-in

Found
A keyboard-only browser test showed the console’s Content-Security-Policy blocked the redirect to Keycloak.
Fixed
The console’s policy was corrected and the fix got its own regression test.
Proof
28 Keycloak protocol checks, from callback replay to back-channel logout, and 5 real-browser checks passed.

Identity run record

AccessOps’ live runs found six gaps that disabling an account leaves open, from a surviving group membership to Kerberos tickets valid for 10 hours. Each was fixed or documented. See all six

Experience

Cybersecurity intern, HNI Corporation.

May–July 2026 · Muscatine, Iowa. Security work in an enterprise environment, from phishing triage to automation that analysts still maintain.

  • 30+identity alerts triaged automatically across 3 alert types in Cortex XSIAM
  • 6 + 2scripts and playbooks for scheduled threat-intelligence updates
  • 3SOC handoff guides with architecture diagrams and test procedures

  1. Incident response and phishing investigation

    Supported incident response using Proofpoint TRAP and VirusTotal; contacted users and classified reported emails as phishing or benign.

  2. Data-loss-prevention investigation

    Investigated potential exposure of Social Security and payment-card data using Proofpoint DLP.

  3. Cortex XSIAM identity-alert automation

    Automated triage for 3 identity-alert types in Cortex XSIAM; processed 30+ alerts without manual review and escalated ambiguous cases to analysts.

  4. Azure security controls and Wiz queries

    Wrote 3 Rego security controls and 6 Wiz Security Graph queries to identify Azure WAF and network-access gaps, validating configurations against defined security requirements.

  5. HPE Aruba EdgeConnect integration

    Integrated HPE Aruba EdgeConnect with Cortex XSIAM through Python REST APIs to support threat-intelligence workflows.

  6. Threat-intelligence scripts and playbooks

    Developed 6 scripts and 2 playbooks for scheduled threat-intelligence updates, with auditable runs and dry-run safeguards.

  7. SOC handoff and technical documentation

    Produced 3 SOC handoff guides with architecture diagrams, testing procedures and troubleshooting instructions so analysts could maintain and extend the automation.

Toolkit

Tools I’ve used.

Grouped by the job they did, with where I used them.

Identity & access

  • Keycloak: OIDC, SCIM, MFA
  • Microsoft Entra ID and Graph
  • Samba AD: LDAPS, Kerberos
  • OPA and Rego
  • Shared Signals: CAEP, RISC

AccessOps · SignalBridge · HNI

Detection & response

  • Cortex XSIAM
  • Wazuh SIEM
  • Sigma rules
  • Splunk SPL
  • KQL
  • Shuffle SOAR
  • Proofpoint TRAP and DLP
  • VirusTotal
  • OWASP ZAP

HNI · SignalBridge

Cloud security

  • Microsoft Azure
  • Wiz Security Graph
  • Rego cloud controls

HNI · Microsoft Applied Skills

Engineering

  • Python
  • Django
  • PostgreSQL
  • TypeScript
  • React
  • Next.js
  • Supabase
  • Docker

All projects

Delivery

  • GitHub Actions
  • CodeQL and dependency review
  • Signed releases with SBOM

AccessOps · SignalBridge · BetTail

Applied AI

  • LLM agents (Claude)
  • Structured output with JSON Schema
  • Tool and environment allowlists
  • Source provenance

Downfield · BetTail

About

Business systems background. Security focus.

I study Management Information Systems at Iowa State, with a minor in Cybersecurity Engineering. I start from how a business process actually runs, like a departure, an alert queue or a shared budget, and build the control or tool that makes it reliable.

How I work

I begin with a concrete failure, such as a leaver who can still sign in, an alert that fires twice or an AI report that cites a page it never read, and work back to a control and a test that would catch it. Then I run that test against the real system, keep the record and write down what it doesn’t prove.

Contact

Let’s talk about the work.

I’m looking for an entry-level security role on a team I can learn from. Email is the fastest way to reach me.

aagarwalcollege@gmail.com

Project screenshot

Open original ↗

View full size to read details. Scroll or swipe to move around the enlarged image.