Data protection
Endpoint and email DLP, exception lifecycles, policy tuning, false-positive reduction, and data handling controls.
Digital GuardianMicrosoft PurviewCASB
ENGINEERING // JOSHUA HERRERA
SYSTEM ONLINE · PUBLIC PORTFOLIO
BUILD SYSTEMS.
UNDERSTAND SIGNAL.
Cybersecurity Engineer specializing in data protection, endpoint and cloud controls, security operations tooling, and the engineering decisions that make defenses practical.
01 / FOCUS AREAS
What I engineer.
From policy controls to investigation workflows, security engineering is about balancing detection, risk, business context, and maintainable operations.
Security telemetry
Security event investigation, data correlation, operational dashboards, alert workflows, and repeatable analysis.
SplunkSentinelSOAR
Cloud & endpoint
Working across endpoints, identity, and cloud visibility to turn technical control decisions into usable defenses.
Defender XDRPrisma AccessEntra ID
02 / INTERACTIVE SECURITY LAB
DLP incident
investigation.
Investigate attempted exfiltration of customer SSNs, PCI cardholder data, and proprietary source code. Distinguish blocked attempts from confirmed disclosures, review evidence, and choose a proportionate response.
Evidence collection
Open each evidence artifact before making a decision.
Select an artifact to inspect its contents.
Response decision
Evidence reviewed: 0 / 3
This lab is an educational simulation of sensitive-data protection. All people, devices, documents, identifiers, payment data, alerts, and event timelines are fictitious or redacted. The scenarios are illustrative, not representations of an employer's internal policies or procedures.
03 / BUILT, NOT JUST DESCRIBED
Selected projects.
Hands-on demonstrations of interface design, engineering thinking, and problem solving.
DLP Investigation Simulator
Investigate synthetic SSN, PCI cardholder-data, and source-code exfiltration attempts through evidence review and risk-based response decisions.
Open lab ↗Detection Engineering Playground
Correlate SSN, PCI, and source-code exfiltration alerts with synthetic email, web, endpoint, and identity telemetry.
Run detections ↗In Frame Before Dark
Personal Astro site featuring terminal interactions, accessible responsive design, and static deployment workflows.
Examine repository ↗Architecture Explorer
Inspect how identity, classification, endpoint, email, web, and SIEM controls work together.
Explore architecture ↗DLP Policy Engineering
Configure SSN, PAN, and source-code detections; measure false positives and missed matches.
Tune a policy ↗Regex Detection Trainer
Write and test regular expressions against labeled synthetic data and refine your detection logic.
Practice regex ↗Engineering Case Studies
Read illustrated design decisions and tradeoffs involving SSN policy tuning, correlation, and exception governance.
Read case studies ↗04 / CONNECT
Technical curiosity
meets real-world constraints.
Explore my work here, or review the code behind the website. For job applications, this page is intended as a companion to my full résumé, not a substitute for it.