I am a Cybersecurity Engineer with hands-on experience in SIEM/XDR operations, incident response, and detection engineering.
I'm responsible for core security operations, working across infrastructure, development, and business teams to investigate incidents, analyze security data, and support infrastructure-level security decisions - regularly collaborating with senior engineers, technical leads, and C-level stakeholders.
My experience spans threat detection, vulnerability management, identity security (Microsoft Entra ID), and application security reviews, including vendor risk assessments. I also bring a background in software development, applying engineering skills to build internal tools and automate security workflows using scripting and AI-based solutions.
Languages: English (Fluent) · Estonian (Fluent) · Russian (Native)
BSc Cyber Security Engineering
Bachelor's thesis: LLM-Enhanced SAST — Reducing False Positives in Detection of Vulnerabilities in Source Code, using a local, uncensored small language model to double vulnerability detection recall while keeping source code private.
An automated DevSecOps pipeline that eliminates SAST alert fatigue and prevents data leakage by triaging vulnerabilities locally on consumer-grade hardware. A custom semantic parser paired with an "abliterated" (uncensored) 4B small language model bypasses AI safety refusals on security-audit code, doubling vulnerability detection recall while keeping source code fully private.
Engineered and rolled out CIS Benchmark-aligned security baselines for Windows endpoints, and streamlined patch management with automated scripting for secure, background deployment of critical security updates.
Developed a secure, interactive command-line vault. Features libsodium encryption (Argon2id, XChaCha20-Poly1305), strict data validation, and Linux clipboard integration.
Single Ansible playbook that turns three bare Ubuntu VMs into a highly available web setup: dynamic DNS with BIND9, replicated MySQL, a Dockerized app tier behind HAProxy with Keepalived VIP failover, plus a full Prometheus/Loki/Grafana monitoring stack and scheduled offsite backups via Duplicity. Secrets are encrypted with Ansible Vault, and config changes to Prometheus/Loki are validated with automatic rollback on failure.
Built a robust SIEM/XDR platform using Wazuh, integrating custom YARA-based detection rules for advanced malware analysis and threat alerting.
Full-stack AI sales assistant with a ChatGPT-style interface, backed by an n8n workflow that coordinates multiple AI agents, contextual reasoning, and RAG-based memory over a PostgreSQL catalog of several hundred products to deliver accurate, context-aware recommendations.
Full-stack web app for budgeting, categorization, and charts with strong security controls against XSS and SQL injection.
AI-based counter-SIGINT prototype that forecasts 24-hour satellite trajectories over target zones and uses a local LLM to generate rule-based deception tactics against SIGINT surveillance.
Co-developed EUMTP (European Union Mail Trust Policy), a proposed EU-wide regulation enforcing SPF, DKIM, DMARC, DNSSEC, and TLS across email services to curb spoofing-driven fraud, with GDPR-inspired compliance audits and phased implementation.
Let’s build secure and intelligent systems together.
