Work / Independent, for financial services, 2026

A security hub that reads the whole request path

A Go service that ingests logs from the edge to the host, runs MITRE ATT&CK-mapped detection rules and streams alerts to a triage dashboard.

@@ where the security signal lived @@

Cloudflare WAF logs in one place, nginx in another, app and auth logs in a third

one HTTP ingestion path, one normalised event shape

geo and ASN enrichment, MITRE ATT&CK-mapped rules

a triage queue and a live request stream on the dashboard

Context

Financial services platforms see a lot of hostile traffic, and the evidence for any one incident is usually spread across the WAF, the API gateway, the application servers and the hosts. I built the security hub as an independent project to put that in one place, with the ingestion and detection core kept separate so it can sit in front of any product.

What I built

The detection engine in Go: HTTP ingestion for Cloudflare WAF and CDN, gateway and nginx, application and host or auth logs; normalisation into one event shape; enrichment with geo and ASN data; a rule engine mapped to MITRE ATT&CK techniques; an alert triage queue; and a live request stream over Server-Sent Events. PostgreSQL through pgx with goose migrations, structured logging with zerolog, and a traffic simulator for development.
The dashboard in React 19: five screens, Hub for live traffic and posture, Alerts for the triage queue, Investigate, Respond and Settings.

Outcome

A standalone service with its own data model, a dashboard that shows the request stream as it happens, and a core that is not tied to the product it was built for.