Kiante Nolen

A modular Python tool that connects live to Active Directory via LDAPS and runs automated IAM security checks, generating timestamped audit reports.

• ▸Runs 4 automated checks: cross-department memberships, disabled accounts in active OUs, accounts with no groups, and 90+ day inactive accounts
• ▸Resolved 7 real technical blockers, including LDAP signing enforcement, LDAPS certificate binding, and Python 3.14's MD4 removal breaking NTLM auth (fixed via pycryptodome)
• ▸Generates professional PDF and HTML reports via reportlab and jinja2
• ▸Scanned 14 users against corp.local, surfacing 2 cross-department violations and 10 inactive accounts

A domain environment built from scratch to practice full identity lifecycle management and privilege auditing.

• ▸Deployed a Windows Server 2025 Domain Controller with 4 OUs and 3 RBAC security groups for domain corp.local
• ▸Provisioned 10 users via PowerShell and executed the full JML lifecycle: joiner, mover, and leaver
• ▸Ran a PowerShell access audit that caught cross-department privilege drift, documented with severity ratings and remediation steps

Live packet capture and forensic analysis, including independent investigation of a real-world malware PCAP.

• ▸Applied 7 display filters to identify a 2,012-packet Nmap SYN scan, RST rejections, and plaintext HTTP exposure
• ▸Independently identified all 5 victim IOCs in a NetSupport Manager RAT PCAP via NBNS, Kerberos, and SAMR analysis
• ▸Produced a SOC-style incident report documenting C2 beaconing over TCP 443 with a full attack timeline

SIEM deployment focused on SSH brute-force investigation, SPL query development, and incident documentation.

• ▸Ingested endpoint and authentication logs and hunted with SPL queries
• ▸Identified failed login patterns, off-hours authentication, and privilege escalation attempts
• ▸Documented findings in formal incident-report format

An open-source EDR deployment across a multi-OS homelab for endpoint detection and compliance scanning.

• ▸Deployed a single-node Wazuh v4.7.5 stack (manager, indexer, dashboard, Filebeat) on Parrot OS with a Windows Server 2025 endpoint enrolled as agent 001
• ▸Simulated an NTLM brute force against the local Administrator account, generating 16 Rule 60122 alerts tagged to MITRE ATT&CK T1078 (Valid Accounts) and T1531 (Account Access Removal)
• ▸Triaged 796 collected events down to the failed-logon signal: status 0xc000006d, logon type 3 (network), 16 failures against 10 successes
• ▸CIS Windows Server 2025 Benchmark scan returned 126 passed / 261 failed for a 32% compliance score, exposing gaps in access control, audit policy, and service configuration

18+ production-ready security automation tools spanning cloud security, threat detection, and network reconnaissance.

• ▸S3 auditor with CRITICAL/HIGH/MEDIUM/LOW risk scoring targeting misconfigurations behind the Capital One breach
• ▸Concurrent TCP port scanner that covers 1,000 ports in 10 seconds, a 100x speedup over sequential scanning
• ▸3-layer brute-force detector (velocity, distributed IPs, account enumeration) and SHA-256 file integrity monitoring