Detection Engineering & Vulnerability Research · Microsoft Sentinel · AI and container infrastructure

I work the defensive side of cloud security: detections that fire on a live Microsoft Sentinel and Defender tenant, each one proven end to end. A control isn't real until you can show it catching the thing it claims to catch, so I build the whole loop (rule logic, controlled trigger, the incident it raises, the investigation, the MITRE mapping) versioned and deployed like code, not clicked into a portal. The good signal is quiet; it sits between two events that both look normal, and it rewards patience over cleverness.

The other half of the work is source-level: I read code in container runtimes, protocol stacks, and the LLM serving stack, and report what I find. Knowing how a thing actually breaks, not just how its alert looks, is what tells you where to point the telemetry.

• Detection engineering on the Microsoft stack: Sentinel (KQL), Defender XDR, Defender for Endpoint, Entra ID.
• Detection-as-Code: versioned rules, PR-gated CI/CD, OIDC deploy, unit-tested and false-positive measured.
• Vulnerability research: static and symbolic analysis (Semgrep, Joern) with a separate verification stage, so what gets reported is what survived verification.
• Three telemetry planes: cloud control plane (Activity Log), endpoint, and identity (sign-ins).
• MITRE ATT&CK mapping, with Sigma for vendor-neutral portability.

• GHSA-7gwp-5pfp-969j (MLflow, Critical): unauthenticated full-read SSRF in webhook delivery. The existing URL guard was bypassable through unvalidated HTTP redirects and DNS rebinding, letting an unauthenticated caller read cloud instance metadata and internal services through the server. Credited independent finder.
• CVE-2026-46517 / GHSA-9xq9-36w5-q796 (lmdeploy): vulnerability in an AI model inference server, resolved through coordinated disclosure.
• Google Cloud VRP award: SSRF, API key disclosure, and response forgery via a per-request baseUrl override in @genkit-ai/google-genai, affecting Gemini and Vertex AI client paths.
• Merged upstream security fixes in Google gVisor, Kubernetes, Azure Sentinel, Swift Package Manager, OSV-Scanner, and Tink-Crypto: container hardening, race conditions, crash handling, sandbox behavior, shared-memory security.
• Coordinated disclosure through Microsoft MSRC, Google VRP, and CERT/CC VINCE.

Blue team through live red-team engagement. Hardened a multi-zone WAN/DMZ/LAN: deployed Security Onion IDS/IPS, Suricata, Zeek, Wazuh HIDS, pfSense firewall rules, honeypots, and automated incident response. Maintained service uptime under sustained attack against a NIST + HIPAA baseline.

Vulnerability research

Detection & cloud (primary)

Defensive operations

Platforms & scripting

Open to remote roles in detection engineering, cloud security, and vulnerability research, and to technical conversation with people working in cloud detection, SIEM engineering, AI infrastructure security, or low-level security.

🔗 LinkedIn: ievgen-jack-bondarenko

🐙 GitHub: ibondarenko1