A Cloud Security, DevSecOps, IT/OT Security, Cyber Resilience, and Governance Engineering Platform — documented from first principles, built in public.
Modern cybersecurity is no longer just about detecting threats.
Security teams are expected to:
- Design secure architectures
- Automate infrastructure deployment
- Engineer resilient systems
- Communicate risk to executives
- Align operations with governance frameworks
- Integrate AI into security workflows
This repository documents the engineering of that capability — end to end.
Every build, configuration, diagram, decision, and lesson learned is captured as evidence. Every control is justified. Every tradeoff is explained.
Every commit represents real work. The history is the evidence.
Most technical documentation explains what to do. This repository explains why it matters, what risk it reduces, and what business problem it solves. Commands are secondary. Reasoning is primary.
Every technology introduced is evaluated through:
- Threat modelling
- Risk analysis
- Tradeoff documentation
- Governance and compliance mapping
- Operational resilience considerations
Architecture Decision Records exist for every significant technical choice — written before the work begins, not after. This includes the conditions under which each decision would be wrong.
Cyber-Lab-v2/
│
├── README.md ← You are here
├── ROADMAP.md ← Progress tracker
├── CASE-STUDY.md ← Nicoliv Energy threat context
│
├── decisions/ ← Architecture Decision Records
│ ├── ADR-001-Git.md
│ ├── ADR-002-SSH.md
│ ├── ADR-003-GitHub.md
│ └── [ADR-004 onward — written before each phase begins]
│
├── diagrams/ ← Architecture and flow diagrams
│
├── 01-Git-Fundamentals/ ✅ Complete
├── 02-SSH-GitHub/ ✅ Complete
├── 03-GitHub/ 🔄 In Progress
├── 04-Terraform/ ⬜ Upcoming
├── 05-AWS/ ⬜ Upcoming
├── 06-CI-CD/ ⬜ Upcoming
├── 07-Docker/ ⬜ Upcoming
├── 08-Kubernetes/ ⬜ Upcoming
├── 09-Cloud-Security/ ⬜ Upcoming
├── 10-Detection-Engineering/ ⬜ Upcoming
├── 11-AI-Security/ ⬜ Upcoming
└── 12-Cyber-Resilience/ ⬜ Upcoming
Establishing version control, authentication, and documentation standards that every subsequent phase depends on.
| Component | Status |
|---|---|
| Git fundamentals | ✅ Complete |
| SSH authentication | ✅ Complete |
| GitHub and repository architecture | 🔄 In Progress |
Everything becomes code. No manual console configuration. The infrastructure definition is the documentation.
| Component | Status |
|---|---|
| Terraform foundations | ⬜ Upcoming |
| AWS core (IAM, VPC, EC2, S3) | ⬜ Upcoming |
| IaC security scanning | ⬜ Upcoming |
Portfolio project: Enterprise AWS environment built entirely in Terraform
Rebuilding IT/OT network segmentation concepts — Purdue Model, IEC 62443 zones — as cloud-native architecture.
| Component | Status |
|---|---|
| VPC design and segmentation | ⬜ Upcoming |
| IAM architecture and least privilege | ⬜ Upcoming |
| Network security controls | ⬜ Upcoming |
Security gates embedded in the delivery pipeline. Every push is scanned before it deploys.
| Component | Status |
|---|---|
| GitHub Actions CI/CD | ⬜ Upcoming |
| Security scanning (tfsec, Checkov, Trivy) | ⬜ Upcoming |
| Secrets management | ⬜ Upcoming |
Portfolio project: DevSecOps pipeline — Push → Scan → Gate → Deploy
Secure workload deployment at scale.
| Component | Status |
|---|---|
| Docker | ⬜ Upcoming |
| Kubernetes (EKS) | ⬜ Upcoming |
| Container security | ⬜ Upcoming |
Detection capability built as code. Controls deployed via Terraform. Alerts that are actionable.
| Component | Status |
|---|---|
| GuardDuty | ⬜ Upcoming |
| Security Hub and AWS Config | ⬜ Upcoming |
| Detection as Code | ⬜ Upcoming |
Portfolio project: Cloud-native detection platform deployed via Terraform
Connecting detection to intelligence. Automating the triage layer.
| Component | Status |
|---|---|
| Alert triage automation | ⬜ Upcoming |
| LLM-generated incident summarisation | ⬜ Upcoming |
| AI SOC integration | ⬜ Upcoming |
Flagship project:
GuardDuty Finding
↓
Lambda
↓
LLM
↓
Incident Summary + Suggested Response
Translating technical operations into executive risk visibility and governance evidence.
| Component | Status |
|---|---|
| GRC operational mapping | ⬜ Upcoming |
| Executive risk reporting | ⬜ Upcoming |
| Resilience framework documentation | ⬜ Upcoming |
End state:
Telemetry → Detection → Investigation → Governance → Executive Risk Communication
All architecture, controls, and threat models in this repository are evaluated against Nicoliv Energy — a fictional Crown-owned natural gas utility operating hybrid IT and OT infrastructure.
The case study defines:
- The organisation's threat profile
- Its IT/OT boundary and vendor access model
- Its regulatory obligations (IEC 62443, NIST CSF)
- The business consequences of security failures
Every significant technical choice is documented in an Architecture Decision Record — including the conditions under which the decision would be wrong.
The goal is not to learn tools.
The goal is to become capable of designing, automating, securing, governing, and communicating enterprise-scale security systems — and to document that capability in a way that leaves no ambiguity about the depth of the work.