Welcome to my portfolio.

For years my personal site ran on WordPress. It worked, but it never matched what I actually do. A public login page that bots hit all day, plugins to keep patched, and a lot of attack surface for what is really a handful of pages. For someone building a career in cybersecurity, that bothered me. So I replaced it.

Why I built this site

This site runs on a small, self-hosted CMS on my own three-node Proxmox cluster. I wanted the site itself to be proof of how I think about security, not just a place that talks about it:

• The editor is hidden and locked down. It lives on a private path, behind a password and a one-time code from my authenticator app.
• The data is encrypted. The database is AES-256 encrypted at rest.
• It runs in a hardened container. Read-only, no root, no extra privileges, behind a firewall that only lets my reverse proxy in.
• It watches for trouble. Scanners looking for /wp-login.php or .env files are blocked and logged. You can see them land on the live threat map on the home page.

I designed the requirements and threat model, deployed it, and run it day to day. I built it with AI-assisted development, which is part of the point: knowing how to direct modern tools safely is a skill in itself. The full breakdown is in the project write-up.

How I got here

My path into security wasn't a straight line, and I think that's a strength.

I spent more than 13 years in leadership and operations. First I was an assistant manager at Goodwill, keeping teams and point-of-sale systems running. Then I was an office manager at Advantage Relocation, where I rolled out ticketing and IT support for the whole staff. Somewhere along the way I realized the part of the job I loved most was the technology, and especially keeping it safe.

So I went all in. I earned my B.S. in Cybersecurity & Information Assurance from Western Governors University. I picked up CompTIA A+, Network+, Security+, CySA+ and PenTest+, plus ITIL v4 and Linux Essentials. Today I'm an IT Specialist supporting HIPAA-regulated platforms, where protecting sensitive data isn't theoretical.

The lab is where I learn by doing

Certifications taught me the concepts. My homelab, Securxlab, is where I practice them:

• An Elastic SIEM collecting logs from every node
• Custom detection rules mapped to MITRE ATT&CK, with a real triage queue
• n8n automation that restarts failed systems, scans for updates and waits for my approval before patching anything
• An AI-assisted repair workflow that once diagnosed and fixed a VM stuck on a stale backup lock by itself

Every one of these taught me something the hard way. That's exactly what I want to share here.

What you'll find on this blog

I'll write about the work I actually do:

• Lab write-ups: how I built something, what broke and how I fixed it
• Detection engineering: rules I write, how I test them and what they catch
• Investigations: walkthroughs of alerts, phishing analysis and practice cases
• Automation: workflows that take the busywork out of security operations

Where I'm headed

My next step is a SOC analyst role, where I can triage alerts, investigate incidents, tune detections and automate the repetitive parts of the job. Longer term I want to grow into detection engineering and incident response, and my experience supporting compliance-heavy environments keeps me interested in GRC too. I'm currently working toward ISC2's SSCP, CC and CCSP.

I bring something a lot of candidates don't: years of leading people, managing operations under pressure and explaining technical problems to non-technical people. Security is a team sport, and those skills matter as much as knowing your way around a SIEM.

Thanks for stopping by

Take a look around: the projects, my resume, and the Resume Checker I built for anyone breaking into cybersecurity. If you're hiring for your SOC, or just want to talk shop, I'd love to hear from you.

— Christofer