Arsen Vaneev

Cloud security, DevSecOps, AI security, automation.

Projects Experience About me AI Arsen
01

Projects

Vulnerability Risk-Acceptance Engine architecture: CrowdStrike Spotlight and Vanta findings are pulled over OAuth, merged and deduplicated by CVE, scored against a five-condition CVSS-vector rubric, and split into 1,611 risk-accepted and 370 patch-now findings in an audit-ready CSV report, all inside a scheduled GitHub Actions workflow.

Vulnerability Risk-Acceptance Engine

Python · GitHub Actions · CrowdStrike Spotlight · Vanta · CISA KEV

During my internship at ElevateBio, I was asked to automate risk acceptance ahead of an ISO 27001 audit. I had the acceptance criteria and a rough scope. My manager's first plan was to configure an enterprise AI agent to make the decisions and write the reports.

After weeks of trial and error, reading documentation and blog posts, and debugging, I came to a different conclusion. The point was to pass an audit, and an auditor has to trace every accepted risk back to the reasoning behind it. Code gives you that line by line. An agent's output is much harder to defend. I pitched a programmatic design to a senior security officer, he agreed, and I built it.

The pipeline pulls findings from CrowdStrike Spotlight and Vanta, deduplicates by CVE, scores each one against a CVSS-vector rubric, and writes a justification naming the compensating control. It cleared 1,611 vulnerabilities before the audit and flagged 370 for patching. It runs on a schedule, and the company still uses it. The AI did end up in the project, just where it fit: an assistant on top that lets engineers ask about their posture in plain English.

Repository ↗
AI Red-Team Harness architecture: an attack suite of Garak, Promptfoo, and PyRIT plants a poisoned document in the vector store and queries the retriever; the retrieved content reaches the LLM (Llama 3 on Ollama, local vs. hosted), and responses are scored for success rate per technique. A mitigation step before the LLM is planned.

AI Red-Team Harness (in progress)

Ollama · Llama 3 · Garak · Promptfoo · PyRIT · OWASP LLM Top 10

In progress. A test suite for attacking self-hosted and hosted LLMs and RAG pipelines, built with Garak, Promptfoo, and PyRIT and mapped to the OWASP LLM Top 10. I learned to build RAG systems in SANS SEC495, and this is where I try to break them. The focus is indirect prompt injection through poisoned documents in a vector store, and measuring how much a mitigation actually lowers the attack success rate.

Repository ↗
SecureLab architecture: on push, GitHub Actions builds a multi-stage non-root image, scans it with Trivy (HIGH/CRITICAL findings stop the build), and publishes it to Docker Hub. Locally, Terraform Cloud manages a kind cluster of 3 control-plane and 3 worker nodes running the Python app, Prometheus, and Grafana.

SecureLab

Actions · Docker · Terraform · Kubernetes · Trivy · Grafana

A passion project to get hands-on with DevSecOps tooling. A friend working in security at a big company told me to learn containers and Kubernetes, so I did.

I'm not running a huge enterprise (yet), so a real cluster made no sense. Then I found kind, short for Kubernetes in Docker, a CLI tool that runs each Kubernetes node as a Docker container. I started small: a GitHub Actions workflow that deployed a basic Python app into a kind cluster. That's where YAML finally clicked for me.

Then I layered security on top: secrets management, Trivy scanning on every build, and Prometheus and Grafana for monitoring.

Repository ↗
02

Experience

Aug 2026 – Present · Remote

Security Intern · CCC Intelligent Solutions

Designing public-exposure detection for an internal Go secret-scanning tool: fingerprinting internal codebases against public GitHub to catch repositories that leaked out through personal accounts.

Jun – Aug 2026 · Durham, NC

Information Security Engineer Intern · ElevateBio

Built the risk-acceptance pipeline above. Contributed to investigations across CrowdStrike Falcon, Palo Alto Panorama, NG-SIEM, Meraki, and Axonius, including a device-attribution chain that traced a suspected malware alert to a WeChat false positive. Worked through 690+ Obsidian posture findings, separating real MFA gaps from service-account and Okta-federated noise.

Jun 2025 – Jun 2026 · Raleigh, NC

Cybersecurity Analyst · NC State OIT

Mapped campus security controls to NIST CSF categories and 800-53 control families, ran third-party vendor risk assessments, and reported compliance posture to leadership weekly.

B.S. Computer Science, Cybersecurity Concentration · NC State · May 2027
GPA 3.8 · Dean's List (6x)

03

About me

I'm a cybersecurity student at NC State who likes building the thing that autoamate manual processed. At ElevateBio that meant a risk-acceptance pipeline an auditor could trace line by line. At CCC it's a scanner that finds company code leaked to public GitHub. On my own time I build labs and attack AI systems to see where they break.

Outside of security, I speak Russian, English, and I'm a fan of and MMA and UFC

Focus

Cloud security, DevSecOps, and AI security. Looking for full-time work starting May 2027.

Certifications

CompTIA Security+ (SY0-701), Feb 2026. SANS SEC495: Building & Securing RAG and Agentic RAG, Jul 2026.

Logistics

Based in Raleigh, NC. US permanent resident, no sponsorship needed.

GitHub LinkedIn Résumé Email
04

Talk to AI Arsen

Under construction

Planned: RAG over write-ups + résumé · citation-required answers · rate limited
Until then: email the human.