Andrew Acevedo
Security engineering across enterprise identity, endpoint, and perimeter defense — backed by human-in-the-loop agentic automation across self-hosted environments.
About
Security is an integrated system, not a disconnected stack of tools. Having engineered and defended 1,000+ user, multi-site hybrid environments, I focus on how identity, endpoints, and perimeter layers intersect.
My background covers the full enterprise defensive surface — securing identities with Okta, investigating threats with CrowdStrike Falcon, and hardening network and perimeter layers across the Fortinet fabric. Beyond enterprise networks, I bring that same architectural rigor to local systems: securing cloud environments and configuring self-hosted agentic AI to automate infrastructure and workflows in my home. The systems I build are purpose-built for high utility, strictly fenced against misuse, and diagnosed down to the root cause — because a restart is never a fix.
Experience
Cybersecurity Specialist
- Detection & response: managed the VMware Carbon Black → CrowdStrike Falcon migration including agent deployment, then ran Falcon as EDR, SIEM and SOAR alongside Falcon Complete MDR.
- Detection engineering & threat hunting: wrote KQL queries over Microsoft Entra ID sign-in and Intune logs and ran Microsoft Defender advanced hunting across Teams and Exchange Online, while owning CrowdStrike SIEM log ingestion for Okta and Fortinet firewall telemetry.
- Identity & access: ran Okta for 1,000+ users — Workflows, MFA policy design, SCIM — with Microsoft Entra ID app registrations, and evaluating PIM.
- Network & endpoint: administered a multi-site FortiGate firewall estate with FortiAnalyzer and a CrowdStrike LogScale forwarder for firewall syslog; administered conditional access policies across Entra ID and Okta.
- Data Loss Prevention & Email Defense: deployed Darktrace AI Email security, configured Microsoft Purview DLP across Exchange Online, and implemented Box Shield DLP — automated content classification and geofencing for HIPAA, financial records and sensitive PII.
- Vulnerability Management: owned risk-based remediation across hybrid infrastructure — prioritizing by environmental exposure and existing compensating controls alongside CVSS severity.
Technical Support Engineer II
Performed system administration duties — managing endpoint security to deploy VPN and enforce policy, configuring SSO with SAML and conditional access (Okta), automating user management and reporting, and maintaining Windows server infrastructure and Active Directory. Provided advanced technical support and mentored junior team members.
Technical Support Engineer I
Owned end-to-end support across Windows, macOS, iOS, and Android while taking on growing systems administration — managing OS updates, application deployments, and SSO administration as VMware Workspace ONE subject-matter expert during the migration to Microsoft Intune.
Microsoft 365 Technical Support Specialist
Expert support for Microsoft 365, resolving complex customer issues and managing installation, configuration, and user/license provisioning across platforms. Documented work in a ticketing system and escalated product bugs.
Information Technology Technician
IT support for NYC clients — deployment and maintenance of Windows and Office 365 environments, Active Directory / Azure AD administration, SOHO network setup, and end-user training.
Projects
Self-directed work across home infrastructure and the cloud, kept separate from the paid roles above. Built, operated and documented in a single-operator environment.
AI-Agent Platform — Continuous Hardened Operation
An autonomous agent running scheduled jobs around the clock is a production system, not a chat window — so it runs with the same isolation, least privilege and monitoring as any server.
- Operates and extends Hermes Agent (Nous Research) as a systemd service on a dedicated Linux host, reachable only over the LAN and a WireGuard tunnel, with Matrix as the primary interface.
- 29 scheduled jobs at last audit — deterministic script-only jobs kept separate from agent-backed ones, per-job state in SQLite, and a watchdog contract where silence must mean evaluated, nothing found.
- Access tiers sized from 42,000+ logged tool executions: required access tier, sensitivity and a deterministic blast-radius score decide whether a capability gets a container, a dedicated VM, or restricted host execution.
- Multi-provider model routing with pinned provider/model strings and token budgets, over a persistent memory stack — including a third-party compaction-guard plugin, evaluated and configured.
- The agent is one process among several: self-hosted Matrix/Synapse for chat, SearXNG for search, and the shared Obsidian vault as the written record — behind restic-encrypted AWS S3 archives on a six-hourly schedule, with a daily verification job and a tested restore path for disaster recovery.
Self-Hosted Inference Node — Hardened Serving Path
An inference endpoint is a high-cost execution API: this node isolates local GPU compute behind a single authenticated gateway with limits measured directly from engine counters.
- Network & Ingress Isolation: Docker Compose stack on Ubuntu Server with zero exposed engine ports; an authenticated LiteLLM proxy and a TLS-terminating reverse proxy act as the sole ingress to the internal llama.cpp (Vulkan/RX 7900 XTX) backend.
- Context & Speculative Execution: hosts a 27B hybrid attention/SSM architecture (17 of 65 layers holding KV state) enabling 128k+ context on 24 GB VRAM; implemented MTP speculative decoding, capturing a measured 2.07x decode speedup over a 6.5-8.5% prefill penalty.
- Measured Operational Envelope: quantified prefill falloff (786 → 261 tok/s, R² = 0.997) and decode rates (69 → 30 tok/s) up to 219k tokens; deployed 128k context across two slots with an 8 GiB RAM prompt cache restoring warm sessions in 148 ms (vs. 7,075 ms cold).
- Hardening & Telemetry: remediated silent VRAM evictions; instrumented Prometheus for engine metrics, GPU wattage, and VRAM/GTT paging; secured host with LUKS2/TPM2 disk encryption and an automation account limited to three read-only sudo commands.
AWS Hybrid Cloud — Zero-Trust Edge and Least-Privilege IAM
The cloud side is run like a production account: one guarded path in, no standing wide access, everything logged and alarmed — at a measured run rate of roughly $1–3 a month.
- A WireGuard bastion is the only route into the private side; a hardened execution host behind it accepts hardware-key (FIDO2) SSH only, and a preflight check fails closed if any broker credential or order-capable path exists off that host.
- Detection pipeline: GuardDuty, CloudTrail, VPC Flow Logs and CloudWatch alarms into SNS, fronted by a Lambda-based, rate-limited, de-duplicated alert pipeline; a CloudTrail brute-force watchdog every 20 minutes and a daily GuardDuty digest.
- IAM discipline: separate deployer, monitor and notify-only identities, a virtual-MFA admin identity, no root use, and read-only defaults for all operational queries.
Home Infrastructure — Segmented Virtualization Platform
A single-operator homelab built like a small enterprise — segmented VLANs, virtualized services, an edge firewall with IDS/IPS — where security decisions get tested before they matter.
- Proxmox VE host (8-core, 62 GB RAM) running six guests across seven VLAN segments, with accelerators passed through to the containers that need them: the Intel iGPU to Jellyfin for hardware transcoding, and a USB Coral TPU to Frigate for local object detection.
- OPNsense on a 4×2.5G-NIC appliance: VLANs, reverse proxy, WireGuard server, IDS/IPS, plus a Python ruleset-extraction toolchain with explicit leak-verification tests.
- Self-hosted services on a hardened LXC provisioning pattern: LAN-only Gitea as the private git origin, Open WebUI with authentication locked down, JupyterLab; documented change runbooks with per-phase rollback.
- Disaster recovery: encrypted snapshot backups to object storage with a daily automated test-restore and an integrity watchdog every 15 minutes; an AWS failover playbook.
This Site — AWS Pipeline and the Prompt Lab
The page you are reading is itself a deployed system — a static site on AWS published by a manual, guarded path I control, carrying an interactive security lab with zero external dependencies.
- Private S3 origin behind CloudFront with origin access control, ACM TLS, Terraform with remote state, and one manual publish command: a credential-shape guard, the upload, a CloudFront invalidation, then a live ETag check against the local build. No CI, no push-to-deploy.
- The prompt-lab console below is self-contained inline JavaScript — no frameworks, no CDNs, no network calls; the browser-only promise in its panes is enforced by construction.
Physical-Security Smart Home — Local-First Home Assistant
A home-automation controller run like a small security system: sensing that keeps working when the network does not, entry events that escalate instead of silently logging, and no inbound path to the house.
- Home Assistant OS on a Raspberry Pi 4 with Zigbee on a USB radio rather than Wi-Fi — contact, motion and vibration sensors, ONVIF cameras, battery telemetry across the sensor fleet, and IoT devices on a segmented VLAN permitted to reach the controller and nothing else.
- Physical security as the design goal: entry and exit detection drives 13 automations — including a night-time entry event that turns on the bedroom lights and announces the door over a Cast speaker.
- Remote access without exposing the house: Nabu Casa Cloud as an authenticated reverse proxy — no port-forward, no WAN-exposed dashboard, control from the Home Assistant companion app.
- Treated as a maintained service, not a novelty: undervoltage and Raspberry Pi firmware entities watched from the dashboard, automatic OS and Core updates deliberately disabled so upgrades land on review, with Cast, Android TV, MQTT and a local voice-assistant pipeline wired in.
Ten browser-only exercises in the failure modes of LLM and agent systems — prompt injection, tool misuse, credential handling, and OWASP agentic-AI risk.
what just happened
Building Toward
Enterprises are rapidly adopting AI while security standards and access models struggle to keep pace. On dedicated infrastructure, I engineer hardened, containerized environments to host agentic systems, using autonomous workflows to manage and monitor my distributed footprint. Across my home and cloud instances, these agents track emerging CVEs, monitor service telemetry and smart-home infrastructure for anomalous activity, audit container health — spanning self-hosted Git repositories, secure chat endpoints, and media services — and compile proactive operational briefs. The Projects section above reflects this work in production: designed, deployed, and operational.
Agentic AI fundamentally shifts security from deterministic code to natural-language execution. The real challenge isn't just model capability; it's scoping agent context, managing short-lived credentials, enforcing domain segmentation, and constraining autonomous execution — an identity and access problem before it is a model problem. My defensive architecture is informed by an attacker's perspective, developed through hands-on threat simulation and reinforced by continuous study toward the CISSP. Understanding how systems break is what makes defense resilient.