Rhyon Caleb
Foz Santos

Protecting livelihoods against more than social engineering. In an increasingly connected world, cybersecurity is the baseline for human throughput and infrastructure survival. My work centers on network traffic forensics, zero-trust perimeter defense, and operational security across untrusted environments.

• Zero-Trust Execution - Perimeter defense is dead. Every service connection, endpoint, and packet is untrusted until cryptographically verified.
• Global OpSec & Network Hardening - Real-world operational security protecting communications and remote access across 30+ untrusted country networks and 250+ transit environments.
• Traffic Forensics & Packet Analysis - Low-level network inspection using packet analyzers and custom scriptable capture tools to isolate threat vectors before escalation.

Creating fair, deterministic rules where there are none. Technical governance is not bureaucratic friction; it is the programmatic codification of ethics, privacy, and compliance directly into software runtime so technology serves human agency.

• Programmatic Guardrails - Enforcing safety policies and compliance controls directly at the code execution layer rather than relying on manual policy documents.
• AI Systems Management (ISO 42001) - Implementing international standards for responsible AI deployment, risk mitigation, and algorithmic accountability.
• Privacy & Data Lineage (ISO 27701) - Architecting secure storage and edge ledgers that uphold user privacy management by default.

Engineering resilient internal AI infrastructure that bridges security policy with ground-level machine learning execution. Moving past chatbot wrappers to build production-grade agentic workflows, model routing, and deterministic evaluation harnesses.

• Deterministic Machine Safety - Guarding non-deterministic neural network outputs with strict schema validation, structured output engines, and evaluation harnesses.
• Multi-Agent Orchestration - Architecting stateful, multi-step agent workflows that execute complex tasks reliably without human bottlenecking.
• Model Routing & Edge Integration - Balancing cost, speed, and privacy by routing requests across open-weight models and edge runtime workers.

Developing Machine Learning models and data processing pipeline solutions to enhance data analysis, search, and intelligent ranking workflows.

Active Internship · Ongoing

• ML Pipeline Development - Building and maintaining scalable data processing pipelines for model training and evaluation.
• Model Research & Optimization - Testing and evaluating ML architectures for search relevance, embeddings, and ranking accuracy.
• System Integration - Integrating ML service endpoints into production workflows.

Active engagement. Details withheld under NDA. Current focus on backend systems, automation, and internal tooling.

Architected under NDA · Ongoing

Independent educator managing curriculum design, student performance tracking, and high-volume remote instruction for international learners.

• Scaled instruction - Delivered live instruction to 100+ students across 10+ countries, adapting pedagogy across CEFR A1–C2.
• Performance analytics - Engineered a custom student-tracking framework to monitor KPIs, isolate learning deficiencies, and adjust trajectories in real time.
• Structured feedback - Produced post-session analytical reports for 100% of sessions with metric-driven visibility.
• High-volume logistics - Managed a peak 52-hour weekly caseload across time zones with 100% attendance compliance.
• Outcomes - Guided students to Distinction/140+ KET, Band 7.0–8.0 IELTS, and successful US Student Visa approvals.

Sole operations & technical lead for a globally traveling executive across multiple countries.

• Sole IT administrator - End-to-end IT for a mobile executive office; uninterrupted connectivity across 30+ countries and 250+ transit environments.
• Network & OpSec - Configured and secured VPN and remote access across 100+ untrusted public networks, protecting comms across 30+ jurisdictions.
• Global connectivity - Managed eSIM/SIM provisioning and cross-border cellular configs with 100% uptime for critical comms.
• OSINT - Conducted OSINT audits on 500+ service providers and hosts, identifying risk indicators to prevent fraud or safety incidents.
• Risk assessment - Pre-deployment geopolitical risk analysis for volatile regions, supporting real-time Go/No-Go decisions.

Provided English instruction and cultural exchange across Ukraine, Myanmar, Nepal, and Vietnam - focusing on communities facing economic instability or geopolitical transition.

• Geopolitical adaptability - Delivered support in high-tension environments preceding major political shifts, requiring rapid adaptation.
• Cross-cultural integration - Bridged linguistic gaps and maintained educational continuity despite external uncertainties.
• Resource management - Adapted teaching methods for resource-constrained settings with minimal infrastructure.

Free and open-source citizen security utility for mapping, analyzing, and warning communities about predatory scam networks in the Philippines. Born from personal experience when family members were targeted by SMS phishing rings - turning private defense into a public-facing threat intelligence tool.

• Tesseract.js 7.0 OCR engine - Instant optical character recognition extracted from SMS screenshots directly in the browser sandbox.
• Verdict matrix engine - Algorithmic evaluation scoring risk (`SAFE`, `SUSPICIOUS`, `HIGH_RISK`) across task scams, investment schemes, and impersonation vector patterns.
• Web Crypto & Recharts HUD - Cryptographic hashing of report signals coupled with interactive threat breakdown charts.
• Community report verification - Crowdsourced dispute and verification workflow to filter noise and preserve signal integrity.

• Client-Side Execution Tradeoff - Swapped server-side OCR endpoints for WebAssembly-compiled Tesseract.js, eliminating server processing costs while achieving 100% offline user privacy.
• Client OCR Latency Benchmark - Average 1.2s local screenshot parsing time; 0ms network latency; 0 byte data leakage to external APIs.

View repository

Client-side browser extension workspace replacing New Tab with a keyboard-first command interface. Named after Vinland Saga ("A place beyond all fighting - peace on the other side of pain"), built to reclaim human attention from algorithmic distraction loops through local-first software engineering.

• Manifest V3 & Service Worker - Isolated background boot pipeline managing cross-tab Pomodoro state, bookmarks, and `declarativeNetRequest` rule filters.
• D3.js v7 force-directed knowledge graph - 273KB zero-dependency mathematical graph visualizing personal Wiki-link connections.
• Spatial canvas & Notion-style block editor - Local-first sharded `localStorage` + `IndexedDB` engine supporting Vim navigation, Kanban boards, and Dataview-lite queries (`LIST FROM #tag WHERE due`).
• 33-command CLI interface - Mouse-free productivity commands (`pomo 25`, `daily`, `canvas`, `task`) operating instantly in place.

• Zero-Dependency Memory Optimization - Replaced bulky React UI libraries with native D3.js v7 canvas rendering, reducing idle browser tab memory consumption from 220MB to 14MB.
• Cold Boot Latency - Sub-16ms Chrome new-tab load time with zero layout shift (CLS: 0.00).

View repository

Tactical overlay and edge-accelerated intelligence network engineered to coordinate complex multi-agent maneuver loops under intense real-time demand without server exhaustion.

• 97% TTFB reduction (<45ms) - Custom `withCache` middleware utilizing Cloudflare Cache API (`caches.default`) reducing edge response time from 1500ms to <45ms.
• HMAC-SHA256 JWT security layer - Web Crypto API authorization enforcing non-repudiation and role-based access control (RBAC) on all tactical requests.
• Antzzzbase strategic intelligence engine - 500-entry rolling snapshot window with 90-day retention tracking enemy habit trends and troop compositions.
• Atomic target locking - Edge-synchronized target lock framework preventing redundant resource allocation across distributed nodes.

• Cloudflare Edge Latency Benchmark - 97% reduction in TTFB (<45ms vs 1500ms baseline) via custom `withCache` middleware hit ratio.
• Architectural Tradeoff - Sacrificed full-relational SQL joins for KV store caching to guarantee sub-50ms edge execution under high traffic bursts.

View repository

Hands-on network-layer security audit evaluating Layer-2 vulnerabilities in a multi-host ARM64 VM and Docker lab subnet simulating corporate network infrastructure.

• Scapy packet forging - Custom Python scripts crafting raw ARP cache corruption packets and forged TCP frames.
• MITM TCP stream interception - Live interception, payload logging, and modification of active TCP sessions between victim nodes.
• Wireshark & tcpdump PCAP forensics - Real-time packet capture, stream reassembly, and protocol anomaly detection.

• Root Cause - Fundamental lack of authentication in ARP (RFC 826) protocol allowing stateless cache overwrite across local Ethernet segments.
• Attack Vector - Unsolicited gratuitous ARP reply injection mapping gateway IP (`192.168.1.1`) to attacker MAC address (`02:42:ac:11:00:02`).
• Remediation & Countermeasures - Enforced Dynamic ARP Inspection (DAI) on managed switches and static ARP table bindings (`arp -s`).

Independent technical analysis of the CVE-2024-3094 XZ Utils supply-chain backdoor - dissecting the multi-year social engineering campaign and stealth binary injection into Linux system compression libraries.

• IFUNC symbol redirection disassembly - Traced GNU indirect function (IFUNC) hooks used to hijack SSHD authentication functions (`RSA_public_decrypt`).
• Liblzma injection vector - Dissected how malicious build stages injected pre-built object files during binary packaging.
• Threat governance model - Mapped adversary tactics against OWASP and supply-chain governance frameworks.

• Root Cause - Multi-year social engineering campaign acquiring co-maintainership of `xz-utils`, inserting obfuscated M4 macro build hooks into release tarballs.
• Attack Vector - GNU `IFUNC` function redirection hijacking `RSA_public_decrypt` in `liblzma.so` during `sshd` startup, enabling unauthorized RCE via forged RSA signatures.
• Remediation & Governance Impact - Immediate revocation of compromised tarball signatures, widespread deployment of audit tools, and revision of open-source maintainer governance models.

Browser-based Incident Command Center simulating forensic post-mortem analysis and incident response workflows for the 2017 WannaCry ransomware attack.

• EternalBlue SMBv1 exploit analysis - Dissected the MS17-010 vulnerability and worm propagation mechanics across enterprise networks.
• Kill-switch domain verification - Visualized the hardcoded kill-switch domain lookup (`iuqerfsodp9ifjaposdfjhgosurijfaewrwergweba.com`) and containment timeline.
• Interactive Command HUD - Built an 8-bit/cyberpunk CRT interface with simulated AI Incident Commander response logs.

• Root Cause - Unpatched Windows SMBv1 buffer overflow vulnerability (MS17-010 / EternalBlue) combined with automated NSA DoublePulsar backdoor injection.
• Attack Vector - Rapid network propagation via TCP ports 445/139 without user interaction, executing AES-128 payload encryption across target filesystems.
• Remediation & Containment - Emergency deployment of Microsoft MS17-010 security patch, blocking port 445 at edge firewalls, and sinkholing hardcoded kill-switch domain.

View repository

Highest management systems auditing fellowship covering both AI management (ISO/IEC 42001:2023) and privacy information management (ISO/IEC 27701:2025).

Lead Auditor certification for Information Security Management Systems (ISMS).

Lead Auditor certification for AI Management Systems - the first international standard for AI management.

Lead Auditor certification for Privacy Information Management Systems (PIMS) - the privacy extension to ISO/IEC 27001.

Two Oracle Cloud Infrastructure 2025 certifications covering core cloud architecture (IaaS, PaaS, SaaS) and the foundational frameworks of AI, ML, and generative AI on OCI.

ID: 323356532OCI25FNDCFA / 323356532OCI25AICFA

Verify on Oracle

Validates foundational knowledge across key security domains including access controls, network security, and security operations.

ID: 2716916

Verify on ISC2

Professional certificate earned by completing a comprehensive 12-course program covering network security and incident response.

ID: NBK2OZ2INAGQ

Verify on Credly

Rigorous program covering fundamentals of information security, threat modeling, and risk management. Engaging with the global CS50 community directly inspired pursuing Python.

Verify on edX

Earned a U.S. high school equivalency diploma with a score of 694, placing in the top 1% of test-takers globally. Achieved through one month of self-directed study across all four subjects.

Verify on GED

This portfolio collects minimal telemetry data solely for operational and security auditing purposes, not for advertising or profiling.

• IP address & geolocation - Resolved at session level via ipwhois.app. Used to assess regional threat posture. Not logged.
• Browser & device fingerprint - GPU renderer, canvas hash, screen resolution, and battery status. Used to detect automation/bot traffic.
• Do Not Track signal - Honored. If DNT is enabled, telemetry is reduced to essential-only mode.
• Referrer - Source of visit for analytics. Stored ephemerally.

• Zero persistent storage - No cookies, no localStorage telemetry logs. Theme preference (`mz-theme`), boot state (`mz-booted`) and opt-out flag (`grc-opt-out`) are the only localStorage entries.
• Opt-out - Toggle the TELEMETRY button (bottom-left) to redact all data. The `grc-opt-out` flag is respected before any collection begins.
• Third parties - Three.js (via esm.sh), Tailwind CDN, Google Fonts, ipwhois.app. Each operates under their own privacy policy.

[email protected] - Data subject requests handled within 30 days per GDPR Art. 12.

This website is a personal portfolio presented for professional evaluation. Access constitutes acceptance of the following terms.

• Personal portfolio context - All content (text, code samples, certification data) is presented as a representation of professional qualifications. Reproduction for commercial purposes is prohibited.
• No warranties - The site is provided "as is" with no guarantees of availability, accuracy, or completeness. The author is not responsible for third-party content linked from this site.

• NLP command palette - The ⌘K terminal accepts natural language queries. No input data is stored or transmitted beyond the client-side NLP parser.
• No user accounts - There is no login, no comment system, and no persistent user session beyond the theme preference in localStorage.

The author shall not be held liable for any damages arising from use of this site or reliance on its content. All technical demonstrations are illustrative and should not be deployed without independent review.

This site operates on a zero-cookie policy for tracking purposes. The only data persisted in your browser is your theme preference and a boot-completion flag.

• mz-theme - Stores your selected theme (moon). No expiration. Cleared via localStorage.removeItem('mz-theme').
• mz-booted - Marks that you've seen the boot sequence once, so returning visits skip it. No expiration. Cleared via localStorage.removeItem('mz-booted').
• grc-opt-out - Stores telemetry opt-out preference. Read before any data collection begins.

• assets/tailwind.css - Utility CSS framework (local build, no external requests).
• fonts.googleapis.com / fonts.gstatic.com - Font loading. Google's privacy policy applies.
• esm.sh - CDN for Three.js. No cookies.
• ipwhois.app - IP geolocation (one request per session, 10,000 req/month free with HTTPS). Their rate limits and privacy policy apply.

Use the TELEMETRY toggle (bottom-left) to opt out of data collection at any time. No cookie consent banner is displayed because no tracking cookies are used.