igor@woz: ~/portfolio — zsh

$whoami

Igor Wozniak

> Cybersecurity & Cloud Security

Cybersecurity student at St. John's University, graduating May 2027. I work on the practical side of security — hardening real environments for small businesses, running a home SOC lab against simulated attacks, and building the tooling I want to understand rather than only reading about it.

AWS Certified Cloud Practitioner and ISC2 Certified in Cybersecurity; taking the CCNA exam in November 2026.

locationQueens, NY
focusCloud security, detection engineering
graduatingMay 2027 · 3.94 major GPA
statusOpen to internships

View projects Get in touch

$ cat ~/about.md

Who I am and how I got here

I'm a Cybersecurity major at St. John's University in Queens, graduating in May 2027 with a 3.94 major GPA.

Most of what I know came from building things and breaking them. I run a home Security Operations Center lab where I deploy a SIEM, tune detection rules, and work simulated incidents end to end. I write the tools I want to understand — a threaded packet analyzer in Python, a file integrity monitor in Bash — because implementing a control teaches you more about it than configuring one does.

Alongside that I volunteer as a security consultant for small businesses, which is where the theory meets people who have a website, no IT staff, and a contact form being hammered by bots. That work is less about sophisticated threats and more about closing the doors that automated attacks walk through every day.

I'm currently focused on cloud security — AWS architecture, least-privilege IAM, and network controls — and working toward my CCNA.

$ ls ~/experience

Roles, and the certifications behind them

Volunteer Cybersecurity & Technology Consultant

Independent · Remote · June 2026 – Present

I help small businesses improve their security posture, working with clients who have real exposure and no security function to speak of. I've assessed and hardened WordPress environments for four clients so far, focusing on the automated attacks that make up the majority of hostile traffic against small public sites. In practice that means closing off contact form abuse and password spraying against administrator login endpoints — rate limiting, CAPTCHA, login throttling, and IP allowlisting — and then building the visibility to know whether it worked. Most clients had no logging at all, so I centralized server log collection and delivered each of them a tailored monitoring dashboard. The part that lasts longest is the training. I work with non-technical owners and staff on MFA enrollment, secure secrets sharing, and credential management, so a one-time remediation turns into a practice they keep up after I'm gone.

Computer Science Tutor

St. John's University · Queens, NY · February 2026 – Present

I tutor undergraduates in Introduction to Java Programming, Algorithms and Data Structures, and Database Management Systems — 20 students across two semesters so far. I run exam preparation sessions and write working examples for the topics that reliably cause trouble: recursion, choosing the right data structure, and SQL query design. Average exam scores among my students improved by roughly 20 percent. The goal is never just a passing grade. Explaining a concept to someone who doesn't have it yet is the fastest way to find the gaps in your own understanding, which is most of why I took the role.

Certifications

Earned and in progress

AWS Certified Cloud Practitioner (CLF-C02) April 2026
ISC2 Certified in Cybersecurity (CC) December 2025
NVIDIA Fundamentals of Deep Learning December 2025
Cisco CCNA — in progress Exam scheduled for November 2026

$ git log --oneline

Click a diagram to zoom it, or a card to read the full write-up

Diagram: packets flowing into a bounded queue, a parser thread draining it, and overflow counted as dropped packets

netalyzer

Python · Scapy · Typer · Rich · Matplotlib

A command-line network traffic analyzer that captures live packets or streams through a .pcap too large to hold in memory, then reports protocol distribution, top talkers, and bandwidth over time. The interesting part is the capture engine. Packet parsing can't be allowed to block the sniffer, so it runs as a threaded producer–consumer pipeline over a bounded queue — the sniffer enqueues, a worker thread parses and records, and packets dropped because the queue filled are counted rather than silently lost. Statistics collection is mutex-protected, filtering is pushed down to the kernel through BPF, and results export to JSON, CSV, or generated Matplotlib charts. Built while working through the Python network traffic analyzer in Carter Perez's Cybersecurity-Projects; the architecture follows that design, the implementation and module layout are mine.

View repository

Diagram: a hardened Ubuntu host feeding a Wazuh indexer, with tuned rules turning raw events into actionable alerts

Home SOC Lab

Wazuh SIEM · Ubuntu · SSH

A home Security Operations Center built end to end so I could practice detection engineering and incident response against attacks I stage myself. I provisioned and hardened the Ubuntu host — key-only SSH authentication, root login disabled, non-default port — then deployed the full Wazuh stack: indexer, search engine, and agent. The work that actually taught me something was rule tuning: getting authentication failures and unexpected file changes to surface as alerts worth acting on, rather than as noise that trains you to ignore the dashboard. File integrity monitoring runs across key server directories to catch unauthorized modification of system binaries and configuration.

Self-hosted — no public repository

Diagram: CloudFront serving a private S3 bucket, and a contact form routed through API Gateway to a Lambda that verifies a captcha before sending mail

Serverless Portfolio Template on AWS

S3 · CloudFront · Route 53 · ACM · API Gateway · Lambda · SES

The original architecture behind this site, published as a template anyone can deploy. A static site lives in S3 and is served through CloudFront with an ACM-issued certificate and Route 53 DNS — the bucket itself stays private. The contact form posts to API Gateway, which invokes a Lambda function that verifies the submission and sends mail through Amazon SES, under an execution role scoped to exactly two permissions: ses:SendEmail and CloudWatch Logs. Captcha tokens are verified server-side against Cloudflare's API rather than trusted from the browser, which is the whole point of a captcha and the step most tutorials skip. The repo ships with a deployment guide covering origin access control, bucket policy, the SES sandbox, running cost, and teardown order.

View repository

Diagram: files hashed into a baseline keyed by inode, with later checks reporting drift

integ

Bash · SHA-256 · Linux

A file integrity monitor small enough to read in one sitting — the core idea behind AIDE or Tripwire, stripped to a single script. It baselines SHA-256 hashes of the files you ask it to watch and reports drift on demand, in three modes: track, check, and update. The design decision worth explaining is that the tracking database is keyed by inode rather than path, so a monitored file that gets renamed or moved within the filesystem stays monitored. That buys resilience and costs you correctness if an inode is recycled — a tradeoff the README documents rather than hides.

View repository

Diagram: layered VPC defenses inspecting egress and east-west traffic, cutting a command-and-control channel

AWS Network Security

AWS Network Firewall · Suricata · DNS Firewall · VPC · CloudWatch

Writeups from the Network Security workshop at AWS Summit NYC 2026, covering six labs on defense in depth across AWS networking. I secured egress traffic out of a production VPC and east–west traffic between production and development using AWS Network Firewall with Suricata-compatible rule groups, then worked a simulated command-and-control compromise and cut the attacker's channel to the victim host. The rest covers WAF, Shield, GuardDuty, DNS Firewall, and Network Access Analyzer, with notes on what each service is actually for.

View repository

Diagram: a raw TCP socket parsed by a state machine, with path traversal segments normalized away before a file is served

bash-http-server

Bash · HTTP/1.1 · TCP sockets

A static HTTP/1.1 file server written in pure Bash — no socat, no netcat, no Python. Sockets come from Bash's own loadable accept builtin. It parses the request line and headers through a small state machine, percent-decodes the path, and normalizes .. segments so requests can't escape the served directory. Each connection is dispatched to a background job, so it serves concurrently. Writing a traversal defense by hand is a different kind of understanding than reading about one. Built following a walkthrough from the You Suck at Programming channel.

View repository

$ mail -s "hello"

Internships, questions about any of the projects, or a small business that needs a second pair of eyes