Systems I design & build,from sensor to decision.

// Approach

• Software-defined-radio front end (HackRF / RTL-SDR / KrakenSDR) that scans the 2.4/5.8 GHz bands, demodulates Remote ID, and fingerprints control protocols like OcuSync and Lightbridge, with direction-finding to locate the operator.
• A sensor-fusion engine that correlates RF bearings, acoustic signatures, and EO/IR camera detections into unified tracks using Kalman/particle filtering, so one drone stays one track across every sensor.
• On-camera computer vision (YOLO + DeepSORT) trained to separate drones from birds and crewed aircraft, classify make and model, and hold a lock while the airframe manoeuvres.
• An edge-first architecture: detection nodes run on rugged low-power compute over MQTT/MAVLink, buffering locally and syncing to a central node so the system keeps working when the network drops.

// Delivers

• Single common operating picture: a live map with track history, heading, altitude estimate, and threat score.
• Geofenced alerting that fires the instant a non-cooperative track crosses a protected boundary.
• Drone-vs-bird classification that cuts false alarms to a level an operator can actually trust.
• Full audit logging for after-action review and detection-model tuning.

// Approach

• Scheduled, respectful collectors and API integrations pull from social, news, forums, public records, and dark-web sources into a normalized ingestion pipeline with dedup and enrichment.
• Entity resolution stitches people, places, organizations, and events across messy sources into one graph, with confidence scoring so analysts can weigh what they trust.
• A link-analysis layer surfaces non-obvious connections through interactive network views, while every geocoded event drops onto a time-aware map.
• Tasking, saved queries, keyword/geofence monitors, and prioritized alerting turn passive collection into active early warning.

// Delivers

• One searchable picture across dozens of sources instead of a dozen open tabs.
• Link-analysis graphs that expose the relationships behind an event, not just the event.
• A geospatial timeline that replays how a situation developed, hour by hour.
• Alerting that flags emerging situations early, in context, and deduplicated.

// Approach

• Fuses AIS vessel tracks, ADS-B flight data, and open satellite imagery into a unified northern picture with PostGIS at the core.
• Pattern-of-life modeling learns normal routes and behaviours, then flags anomalies: AIS gaps, loitering, unusual approaches, and dark-vessel rendezvous.
• Change detection over imagery highlights new activity in remote areas between passes.
• An interactive northern map with time-scrubbing lets an analyst replay days of movement and drill into any track.

// Delivers

• A single northern common operating picture instead of siloed feeds.
• Automatic flagging of AIS-dark and anomalous behaviour.
• Time-aware replay for reconstructing what happened, and when.

// Approach

• Scheduled collection ingests and archives every advisory, tracking per-country and per-region risk levels as a full time series.
• Renders advisory history as an interactive map and timeline, surfacing escalations and de-escalations across the globe at a glance.
• Light NLP correlates advisory changes with news and world events to explain why a country’s risk moved, not just that it did.

// Delivers

• A complete, queryable history of advisories that would otherwise vanish on update.
• At-a-glance global view of who is escalating and de-escalating.
• Event correlation that turns a status change into a story.

// Approach

• Wideband scanning across ISM bands with HackRF and RTL-SDR, waterfall capture, and automated signal detection in GNU Radio.
• Protocol fingerprinting characterizes control and video links and builds a reusable signature library.
• Direction-finding with coherent multi-channel SDR (KrakenSDR) estimates bearing to the emitter.
• Detections and signatures export straight into the counter-UAS fusion engine as another sensor.

// Delivers

• Automated detection and labelling of drone RF activity from raw spectrum.
• A growing signature library that sharpens classification over time.
• Bearing estimates that help geolocate the operator, not just the aircraft.

// Approach

• A fleet of honeypots behind hardened networking, VPN, and network-wide DNS filtering captures intrusion attempts across services.
• Attack telemetry is aggregated, geolocated, and dashboarded to surface sources, tactics, and trends.
• Findings feed back into hardening playbooks and detection rules for the systems I build and operate.

// Delivers

• A live stream of real-world attacker tactics instead of theory.
• Geolocated dashboards of intrusion attempts and their patterns.
• Hardening and detection improvements grounded in what actually gets tried.

// Approach

• Python ETL with SQLAlchemy bulk operations and async I/O, engineered up to 40× faster than the predecessor pipeline, with data-quality gates at every stage.
• PostGIS-backed spatial analysis for zone assignment, trip chaining, and origin–destination matrices at metropolitan scale.
• Statistical weighting against census profiles for households, persons, and trips, with reproducible notebooks and automated validation.
• SurveyJS-driven data collection integrated with Flutter field apps for offline-capable interviewer workflows.

// Delivers

• Million-record studies processed in hours instead of days.
• Reproducible weighting and validation that survives peer review.
• Self-serve Superset dashboards for project teams and clients.
• Standardized ETL patterns reused across multiple large studies.

// Approach

• Mapped every proprietary workflow to an open-source equivalent: time tracking, project management, analysis, and reporting.
• Deployed and administered Apache Superset with connected data sources, governed metrics, and role-based access.
• Built custom dashboards and SQL models so project teams explore study progress, staffing, and deliverables without writing queries.
• Ran training and documentation so adoption stuck past the initial migration.

// Delivers

• Predictable infrastructure costs instead of escalating SaaS licenses.
• Data sovereignty: client and operational data stays in-house.
• Self-serve dashboards across teams that previously relied on manual reports.
• A reusable playbook for open-source process transformation.

// Approach

• Document ingestion pipeline: chunking, metadata extraction, and embedding with open models into pgvector or Chroma.
• Ollama and vLLM for local inference: chat, summarization, and structured extraction without third-party API calls.
• Hybrid retrieval combining semantic search and keyword filters, with source citation and query logging.
• LangChain orchestration for multi-step RAG workflows and tool-using agents wired into existing systems.

// Delivers

• Grounded answers over proprietary documents with full data sovereignty.
• Queryable embedding index with measurable retrieval precision.
• Agent workflows for research triage and document summarization.
• Cost-controlled AI that scales without per-token billing surprises.

// Approach

• Ingests AIS feeds into PostGIS with spatial indexing for real-time and historical track storage.
• Pattern-of-life models learn normal routes, speeds, and port-call behaviours per vessel class and region.
• Anomaly detection flags AIS gaps, identity changes, loitering, unusual approaches, and dark-vessel rendezvous.
• Interactive map with time-scrubbing replays track history and correlates anomalies with contextual events.

// Delivers

• Automatic surfacing of AIS-dark and anomalous vessel behaviour.
• Replayable track history for investigative and after-action analysis.
• Feed integration into broader domain-awareness and OSINT fusion platforms.

// Approach

• React front end with deck.gl map layers for live tracks, history trails, sensor coverage, and geofence boundaries.
• FastAPI WebSocket backend pushing track updates, alert events, and system health in sub-second latency.
• Threat scoring engine combining classification confidence, proximity to protected assets, flight behaviour, and airspace rules.
• Offline-first edge deployment with local buffering and sync, so the COP stays live during network interruptions.

// Delivers

• Single operator picture across all fused sensor tracks.
• Geofenced alerting with full audit trail for compliance and after-action review.
• Sub-second update latency at the edge on rugged hardware.
• Threat prioritization that cuts operator cognitive load.

// Approach

• Cross-platform Flutter apps with local SQLite storage, validation rules mirroring the central schema, and background sync when connectivity returns.
• SurveyJS web questionnaires with complex branching logic, validation, and quota management for tablet-based collection.
• Python ingestion pipelines that reconcile field submissions, flag quality issues, and load into PostgreSQL for analysis.
• Admin dashboards for monitoring interviewer progress, quota fills, and data-quality metrics in near real time.

// Delivers

• Reliable data collection in low-connectivity field environments.
• Complex survey logic enforced consistently across web and mobile.
• Automated ingestion with quality gates before analysis begins.
• Real-time visibility into field progress for study managers.

// Approach

• Distributed microphone nodes with GPS time-sync capture wideband audio and run edge DSP for harmonic peak detection and rotor-class feature extraction.
• Beamforming and TDOA estimates azimuth to complement bearing-only RF hits when line-of-sight to the operator is blocked.
• Event payloads (timestamp, bearing, confidence, spectral features) publish over MQTT to the fusion engine rather than streaming raw audio.
• Per-site noise-floor calibration and seasonal retuning reduce false alarms from HVAC, traffic, and event crowds.

// Delivers

• Additional detection modality when RF and camera coverage are weak.
• Bearing estimates that improve cross-sensor track association.
• Privacy-preserving telemetry: features, not audio recordings, leave the node.

// Approach

• Scheduled ingestion from RSS, APIs, and structured event databases with deduplication and language detection.
• spaCy and transformer NER extract people, organizations, locations, and event types; geocoding resolves place names to coordinates with confidence scores.
• Time-windowed correlation joins entity spikes and geocoded mentions to platform events: advisory updates, AIS anomalies, geofence alerts.
• Summarization templates produce analyst-readable briefs with linked sources, not opaque model prose.

// Delivers

• Automated "why did this change?" context on dashboards and alerts.
• Searchable archive of geocoded news tied to operational events.
• Reduced time from alert to situational understanding.

// Approach

• Python engine implementing raking/calibration with configurable cells for geography, household size, tenure, and trip purpose.
• Automated validation against census marginals with tolerance thresholds and exception reports for extreme weights.
• Versioned inputs and outputs with run metadata (analyst, code hash, control file version) for reproducibility.
• Integration hooks export weighted tables directly into PostGIS analysis and Superset dashboards.

// Delivers

• Consistent methodology across multiple large studies.
• Faster iteration when census controls update mid-project.
• Audit-ready documentation for client and peer review.

// Approach

• Terraform modules for AWS, Linode, and generic VPS providers with consistent tagging, firewall rules, and SSH key management.
• Ansible playbooks apply hardened baselines: unattended upgrades, fail2ban, Suricata, Docker, and reverse-proxy templates.
• WireGuard full-mesh VPN for admin access without public SSH on every host.
• Centralized backup schedules and Datadog agent deployment with service-specific monitors.

// Delivers

• Reproducible server builds in minutes, not afternoons.
• Consistent security posture across the fleet.
• Observable hosts with alerts before disks fill or certs expire.

// Approach

• Ingestion watches folders and S3-compatible buckets; Tesseract and layout models extract text with page-level coordinates.
• Structured field extraction for recurring form types using templates and light fine-tuned models.
• Chunking with metadata (document ID, section, date, classification) embedded into pgvector for semantic search.
• FastAPI endpoints return excerpts with citations for RAG and human review queues.

// Delivers

• Searchable corpus over previously opaque document archives.
• Grounded answers with page-level citations.
• Reduced manual transcription for recurring document types.

// Approach

• Normalized event schema: source, severity, geo, entity IDs, confidence, and TTL.
• Deduplication windows collapse repeated geofence or keyword hits into one escalated thread.
• Routing rules by category, geography, and on-call schedule; webhook integrations for external ticketing.
• Audit log of deliveries, acknowledgements, and suppression rules for post-incident review.

// Delivers

• One prioritized alert stream instead of siloed notifications.
• Fewer duplicate pages during high-tempo events.
• Traceable escalation history for compliance and tuning.

// Approach

• Scheduled nmap and service fingerprint scans from a dedicated jump host per segment.
• Inventory stored in PostgreSQL with history: new port, service change, missing host.
• Graph view of host relationships and reverse-proxy routes; diff view after firewall changes.
• Integration with honeypot telemetry to flag scans that match observed attacker patterns.

// Delivers

• Living network map instead of stale spreadsheets.
• Faster answers during incidents: what changed, what is exposed.
• Evidence for hardening priorities backed by scan history.