Skip to content
View aman-agarwal6's full-sized avatar

Achievements

Achievement: Pull Sharkx2

Achievements

Achievement: Pull Sharkx2

Block or report aman-agarwal6

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
aman-agarwal6/README.md

Aman Agarwal: security engineering and applied AI. Iowa State MIS, CompTIA Security+, former HNI cybersecurity intern. Open to entry-level security and AI roles from January 2027.

I build security controls and AI-powered tools, test them against real systems, and publish what failed alongside what passed. MIS senior at Iowa State with a Cybersecurity Engineering minor, graduating December 2026; CompTIA Security+; former cybersecurity intern at HNI. Open to entry-level roles in security engineering, security operations or identity and access management, and AI engineering or automation roles, from January 2027.

Portfolio · Recruiter summary · LinkedIn · Email

Featured projects

AccessOps public demo with synthetic data: a departure case, its next step and the evidence source of each required action

AccessOps

Disabled isn't done. Automated employee offboarding that proves the person's access is really gone. An HR event shuts off their access in Microsoft Entra ID, Keycloak and an Active Directory-compatible directory, and each system is checked to confirm the change.

  • 2.6 s from the HR event to the person signed out and their tokens blocked
  • 6 gaps found by live testing, each fixed or documented
  • 20 s for Microsoft Entra ID to confirm the change, in a test tenant

Case study · Live demo · Source

SignalBridge identity detection results: 18 of 21 attacks caught on public attack logs, compared with SigmaHQ's rules

SignalBridge

Catch identity attacks in the logs a SOC already has. Sigma rules for password spraying, Kerberoasting, MFA fatigue and device code phishing in Windows and Microsoft Entra ID logs, tested on public attack data and compared with the community's rules. A lab version catches access that should have ended.

  • 18 of 21 public attack captures caught by my 13 rules, with no alerts on unrelated files
  • 3 community Entra rules I found can't fire on real log exports
  • 4 writes a removed user could still make, until I found and fixed the race

Case study · Source

The two work as a pair: AccessOps sends a signed event for each offboarding step, and SignalBridge verifies those events and opens a critical case if a departed account is used anyway.

More projects

Project What it is Highlight
BetTail Live web app where private groups share sports picks and track results Profit, ROI and leaderboards calculated in the database; row-level security on every exposed table; 6 fixes from my security review
Netted Personal-finance app for trade profit, shared funds and budgeting Accounting rules written before any code; MFA enforced in the database; 7-item risk register
Downfield Local AI research agent that writes structured NFL reports for BetTail 32 games across two NFL weeks and 415 saved reports so far; every report checked by code; forecasts graded after each game

BetTail, Netted and Downfield are private; their case studies link selected code and tests.

Experience

Cybersecurity Intern, HNI Corporation · May–July 2026
Automated triage for 3 identity-alert types in Cortex XSIAM (30+ alerts handled without manual review), supported phishing response and data-loss investigations with Proofpoint, built Python threat-intelligence integrations, and wrote Rego controls and Wiz queries for Azure.

Toolkit

Identity & access
Keycloak: OIDC, SCIM, MFA Microsoft Entra ID and Graph Samba AD: LDAPS, Kerberos OPA and Rego Shared Signals: CAEP, RISC

Detection & response
Cortex XSIAM Wazuh SIEM Sigma rules Splunk SPL KQL Shuffle SOAR Proofpoint TRAP and DLP VirusTotal OWASP ZAP

Cloud security
Microsoft Azure Wiz Security Graph Rego cloud controls

Engineering
Python Django PostgreSQL TypeScript React Next.js Supabase Docker

Delivery
GitHub Actions CodeQL and dependency review Signed releases with SBOM

Applied AI
LLM agents (Claude) Structured output with JSON Schema Tool and environment allowlists Source provenance

Pinned Loading

  1. AccessOps AccessOps Public

    Automated employee offboarding that proves access is really gone: an HR event shuts off access in Microsoft Entra ID (test tenant), Keycloak and an AD-compatible directory, and each system is checked.

    Python

  2. signalbridge signalbridge Public

    Sigma rules for identity attacks in Windows and Microsoft Entra ID logs, tested on public attack data and compared with SigmaHQ: 18 of 21 attacks caught. Plus a lab that catches access that should …

    Python

  3. aman-agarwal6.github.io aman-agarwal6.github.io Public

    Portfolio of Aman Agarwal: security engineering and applied AI case studies.

    HTML