Projects by Salman Tabrez
Documented. Architected. Executable.
Each project addresses a real security gap with a defined architecture, toolchain, and measurable outcome. Not tutorials — engineered solutions.
Microservices Threat Model & Security Control Map
Comprehensive STRIDE-based threat model for a microservices e-commerce platform — API gateway, authentication, payment, and order services. Mapped 23 threat scenarios across 5 trust boundaries with prioritized compensating controls and residual risk ratings.
Automated Security Gate Pipeline
End-to-end GitHub Actions CI/CD pipeline with four parallel security scanning stages — SAST via Semgrep with custom rule packs, container image SCA via Trivy, infrastructure-as-code validation via Checkov against CIS benchmarks, and DAST baseline scan via OWASP ZAP. PRs with CRITICAL or HIGH findings are automatically blocked.
AWS IAM Least-Privilege Audit & Remediation Engine
Python-based tooling using Boto3 and IAM Access Analyzer to programmatically audit IAM policies across an AWS organization. Detects over-permissioned roles, generates scoped-down policy recommendations, and produces before/after comparison reports with risk severity scoring.
Detection-as-Code: SIEM Correlation Pipeline
Elastic SIEM deployment with structured log ingestion from CloudTrail, VPC Flow Logs, and application telemetry. 15+ custom KQL correlation rules version-controlled as YAML in Git, each mapped to specific MITRE ATT&CK techniques with documented detection rationale and tuning methodology.
EKS Security Hardening & Runtime Threat Detection
Production-grade EKS cluster deployed via Terraform with defense-in-depth security — granular RBAC per namespace, deny-all-default network policies, restricted pod security standards, and Falco for runtime anomaly detection including container shell access and unexpected process execution.