Cyber Ops since 2007

Hiago Kin Levi

I implement work processes and tactics and build defensive security tooling and public educational material across incident response, DFIR, cloud security, IAM, WAF, secrets detection, AI security, containers, phishing monitoring, and applied cryptography. My mission is to empower security teams worldwide with battle-tested tools that bridge the gap between theoretical knowledge and real-world defensive operations.

GitHub Profile LinkedIn Paper Files About Me

01 / Focus

Current Public Focus

Defensive-only cybersecurity tooling — every tool in this portfolio is designed exclusively to protect, detect, and respond to threats. No offensive exploitation without coordinated disclosure.
Tested, documented, and reusable engineering assets — each repository follows software engineering best practices including automated testing, comprehensive documentation, usage examples, and modular architecture for easy integration.
Security education for beginner to advanced teams — all materials are structured as progressive learning paths, starting from foundational concepts and building up to advanced techniques used by enterprise security operations centers (SOCs).
Continuous micro-iteration across a 13-repository portfolio — each project receives regular updates, security patches, and feature improvements based on community feedback and evolving threat landscapes.

02 / Domains

Core Domains

Incident Response and DFIR — the discipline of detecting, investigating, and recovering from security incidents. This includes forensic artifact collection, timeline reconstruction, malware triage, memory analysis, and post-incident reporting to prevent future breaches.
Cloud Posture, IAM, and Container Security — comprehensive coverage of cloud-native security challenges including misconfiguration detection, identity governance, least-privilege enforcement, Kubernetes hardening, and continuous compliance monitoring across AWS, Azure, and GCP.
WAF Defense, AppSec, and Secure Pipelines — protecting web applications at every layer: from WAF rule optimization against OWASP Top 10 attacks, to static/dynamic application security testing (SAST/DAST), to integrating security gates into CI/CD pipelines for shift-left security.
AI Security, Secrets Monitoring, and Applied Cryptography — addressing emerging threats from AI/ML systems including prompt injection and data poisoning, combined with proactive secrets leak detection across repositories, and implementing cryptographic best practices for data protection at rest and in transit.

Portfolio

Cyber Port Repositories

A comprehensive 13-repository defensive security ecosystem, meticulously crafted and released under CC BY 4.0 license. Each repository addresses a critical domain of cybersecurity with production-ready tools, detailed documentation, and educational resources.

Detection

honeypot-foundry

A complete enterprise-grade toolkit for deploying, managing, and monitoring honeypots — deceptive systems that simulate vulnerable services to attract and analyze malicious activity in real time.

Explore →DFIR

dfir-attack-lab

A fully self-contained attack simulation laboratory purpose-built for Digital Forensics and Incident Response (DFIR) training, featuring realistic compromise scenarios and pre-generated forensic artifacts for hands-on analysis.

Explore →AppSec

waf-defense-rulepacks

Battle-tested, production-ready rule sets for Web Application Firewalls (WAFs), providing comprehensive protection against OWASP Top 10 attacks, API abuse, and modern bypass techniques for ModSecurity, AWS WAF, and Cloudflare.

Explore →DevSecOps

secure-pipeline-blueprints

Production-ready templates and blueprints for building secure CI/CD pipelines that integrate SAST, DAST, SCA, secret scanning, and security gates — enabling true shift-left security in modern software development workflows.

Explore →AI Security

ai-security-guardrails

A comprehensive security middleware framework for AI and LLM-powered applications, providing protection against prompt injection, data leakage, adversarial manipulation, and misuse through configurable guardrails and real-time monitoring.

Explore →IAM

iam-audit-lab

An automated platform for comprehensive auditing and assessment of Identity and Access Management (IAM) policies across multi-cloud environments, identifying excessive privileges, orphaned accounts, and policy violations with remediation guidance.

Explore →Cloud

cloud-posture-watch

A continuous cloud security posture management (CSPM) system that monitors compliance with CIS Benchmarks, detects configuration drift in real time, and provides automated alerting on exposed or misconfigured cloud resources.

Explore →Containers

container-defense-stack

A comprehensive, defense-in-depth security suite for containerized environments, providing image vulnerability scanning, runtime threat protection, network policy enforcement, and compliance auditing for Kubernetes and Docker.

Explore →IR

ir-playbooks-automation

A library of automated, SOAR-integrated playbooks for security incident response, covering the complete response lifecycle for phishing, malware, ransomware, account compromise, and data breach scenarios with step-by-step orchestration.

Explore →Crypto

cryptologik

An applied cryptography toolkit providing secure, audited implementations of cryptographic algorithms, TLS configuration analysis, certificate lifecycle management, and educational resources for understanding cryptographic principles.

Explore →Research

offensive-gvuln

A responsible vulnerability research toolkit featuring custom fuzzers, binary analysis tools, and exploit development frameworks — all designed for ethical security research with coordinated disclosure as a core principle.

Explore →Phishing

phishing-surface-monitor

An automated monitoring system that continuously detects phishing domains, cloned websites, and social engineering campaigns targeting your organization by analyzing certificate transparency logs, DNS registrations, and visual similarity.

Explore →Secrets

secret-leak-sentinel

A comprehensive secrets detection and prevention platform that continuously monitors repositories, logs, CI/CD artifacts, and cloud environments for leaked credentials, API keys, tokens, and certificates — with automated alerting and remediation workflows.

Explore →