Computer Science graduate from the University of Parma, now a MSc student in Cybersecurity (LM-66) at Sapienza University of Rome. I build home labs, break things to understand how they work, and document everything I learn.
Hands-on experience with vulnerability assessment, SIEM deployment (Wazuh), network security monitoring, and Linux hardening. I approach security from both the offensive and defensive side.
Currently seeking junior cybersecurity analyst positions - also available for freelance cybersecurity work via my portfolio.
In italiano
Laureato in Scienze Informatiche all'Universita di Parma, ora studente della Laurea Magistrale in Cybersecurity (LM-66) alla Sapienza di Roma. Costruisco laboratori, analizzo sistemi per capirne le vulnerabilita e documento tutto cio che imparo.
Esperienza pratica in vulnerability assessment, deployment SIEM (Wazuh), network security monitoring e hardening Linux. Approccio la sicurezza sia dal lato offensivo che difensivo.
Attualmente alla ricerca di posizioni junior come cybersecurity analyst, disponibile anche per collaborazioni freelance in ambito sicurezza.
| Certification | Status | Progress |
|---|---|---|
| Cisco CCNA (200-301) | 📖 Studying | |
| CompTIA Security+ (SY0-701) | 📖 Studying | |
| eJPT (eLearnSecurity) | 🎯 Next | - |
| BTL1 (Blue Team Level 1) | 🎯 Planned | - |
| Cybersecurity Labs |
Full-stack cybersecurity training environment with 10 progressive modules - from OSINT reconnaissance and vulnerability scanning to web exploitation, privilege escalation, post-exploitation, and digital forensics. Each module follows the Kill Chain methodology and is mapped to the MITRE ATT&CK framework. 60 documented findings across recon, vulnerability assessment, web, and system exploitation - written up like a real engagement, with executive summary, report standards, and certification mapping. Complete VirtualBox lab topology, secure coding remediation, and fully bilingual (EN/IT) documentation. Python, Bash, Docker, VirtualBox, MITRE ATT&CK, MkDocs |
|
| Security Home Lab |
Real-world home security infrastructure built on a Raspberry Pi 5 (8GB RAM, NVMe SSD). Runs a full SOC-style stack: Wazuh SIEM for log collection and threat alerting, Cowrie SSH/Telnet honeypot for intrusion detection, WireGuard VPN for secure remote access, and Pi-hole for DNS-level filtering. Network hardened with VLAN segmentation, UFW firewall rules, and Fail2ban. All services containerized with Docker and managed through Portainer, with a modular automation script that redeploys the entire stack (hardening, Docker, Pi-hole, WireGuard, Cowrie, VLAN, Wazuh) from scratch. Also serves as a secure NAS via OpenMediaVault. Bilingual docs (EN/IT). Linux, Bash, Docker, Portainer, Wazuh, WireGuard, Pi-hole, Cowrie, OpenMediaVault |
|
| Tor Network Analysis |
Comprehensive technical deep-dive into the Tor network - covering onion routing protocol mechanics, circuit cryptography (AES-128-CTR, ntor handshake), directory authority infrastructure, and bridge/relay configuration. Documents known attacks and defenses (traffic correlation, browser fingerprinting, DNS leaks), operational security best practices, and legal/ethical considerations. Includes 5 hands-on labs from basic setup to hidden service deployment, automation scripts, and 210+ automated validation checks. Fully bilingual documentation (EN/IT). Tor, Shell, Python, Proxychains, Network Security, OPSEC |
|
| Hardware Security Research |
Security research and auditing of physical access control systems using Flipper Zero with Rogue Master firmware. Covers Sub-GHz radio signal capture and replay, NFC/RFID tag cloning and security assessment, infrared protocol analysis, and BadUSB payload development for authorized penetration testing. Explores GPIO integration and hardware hacking fundamentals. Bilingual docs (EN/IT). Flipper Zero, C, Radio Protocols, NFC/RFID, GPIO, BadUSB |
|
| CTF Writeups |
15 Capture The Flag writeups across 7 categories - web exploitation, privilege escalation, forensics, network analysis, cryptography, reverse engineering, and misc (OSINT, steganography). Every writeup is mapped to MITRE ATT&CK and documents the full methodology: reconnaissance, vulnerability identification, exploitation, and lessons learned. Python, Bash, Burp Suite, Wireshark, Ghidra, Volatility |
|
| Detection Engineering |
Library of custom detection rules across 4 major formats: Sigma (SIEM-agnostic), Yara (malware detection), Suricata (network IDS), and Wazuh (HIDS/SIEM). Rules organized by MITRE ATT&CK tactic - from credential access and lateral movement to exfiltration and C2 detection. Includes lab setup guides, Atomic Red Team test mappings, Kibana/Grafana dashboards, and CI/CD rule validation. Full ATT&CK Navigator coverage heatmaps. Sigma, Yara, Suricata, Wazuh, ELK Stack, MITRE ATT&CK |
|
| SOC Toolkit |
Production-grade SOC analyst suite - a monorepo shipping two apps on a shared library: soc-toolkit (blue-team workflows) and osint-toolkit (attack-surface management and investigative OSINT). 10 analyst modules: Phishing Analyzer, Log Analyzer, IOC Extractor, IOC Pivot, YARA Scanner, Sigma Detection, MISP Enrichment, File Inspector, Link Analyzer, QR Analyzer. Enrichment via VirusTotal, AbuseIPDB, Shodan, URLScan.io, OTX, and MalwareBazaar. Optional JWT accounts (single-tenant or SaaS), offline Ed25519 license activation, HTTPS reverse proxy, bilingual UI (EN/IT), and JSON/CSV/PDF report export. Now a private, commercial product - the self-hosted SOC Suite ships as a Dockerized deploy package. Python 3.12, FastAPI, React 18, TypeScript, Vite, Tailwind, Docker |
🔒 Private |
| Citizen Shield |
Personal OPSEC, privacy and citizen-defense platform for people dealing with cyberstalking, doxxing, sextortion or a compromised device. Split architecture by design: a cloud control plane (FastAPI - accounts, licensing, live WebSocket dashboard) plus a local Docker agent that runs every scanning tool on the user's own machine, so no heavy tooling ever executes on my infrastructure. 8 modules: digital-footprint OSINT, data-broker opt-out, sextortion panic room, smart-home sanitizer, phishing and scam triage, travel OPSEC, cloud account lockdown, and mobile stalkerware forensics. Privacy layer built in: zero-knowledge AES-256-GCM client-side encryption, enforced retention with hard-delete countdown, a Quick Exit panic button, and SHA-256 + RFC 3161 timestamped PDF reports. In development - private, closed-source product. Python 3.12, FastAPI, SQLAlchemy 2.0, PostgreSQL/JSONB, React 18, TypeScript, Tailwind, Docker, Nuitka |
🔒 Private |
| FinanzMe |
Self-hosted, multi-user personal finance tracker (2-5 people) with automated expense tracking via PSD2 open banking (GoCardless Bank Account Data), designed to be extensible toward a future stocks/ETF trading bot. Microservices architecture: a Java 21 + Spring Boot 3 core API, a Python 3.12 + FastAPI analytics/ML service, and an async RabbitMQ ingestion worker for open-banking fetches. Hardened platform by design: Keycloak (OIDC/JWT) for auth, HashiCorp Vault for secrets, Traefik v3 for edge TLS, PostgreSQL 16 + TimescaleDB and Redis for persistence, and a full Prometheus + Loki + Grafana observability stack. Runs HTTPS-only behind Traefik, with brute-force protection, enforced password policies and PKCE on the auth layer. In development - private repository. Java 21, Spring Boot 3, Python 3.12, FastAPI, React 18, TypeScript, PostgreSQL/TimescaleDB, Redis, RabbitMQ, Keycloak, Vault, Traefik, Docker |
🔒 Private |
| Portfolio Website |
Personal portfolio and freelance services site built as a React SPA - bilingual content (EN/IT), light/dark theme, terminal-style animations, and client-side routing. Showcases education, projects, cybersecurity architect/engineer services, and dedicated product pages for the SOC Suite (with a downloadable deploy package) and Citizen Shield. Live at nicholas-arcari.github.io/portfolio-nicholas. React 19, Vite, React Router 7, JavaScript, CSS, GitHub Pages |
|
Beyond the labs and open-source work, I design and secure real production systems. As part of an Industry 4.0 freelance engagement I authored the security architecture for an IT/OT convergence scenario: a Docker-based industrial production-management platform (machine communication over OPC-UA / Modbus) that had to expose a public-facing microservice while previously air-gapped PLC and HMI controllers were still sitting on a flat network.
The engagement re-architected the environment end to end:
- Segmentation - Purdue model with an Industrial DMZ (Level 3.5), VLAN isolation, Hyper-V vSwitch separation, and an IEC 62443 "Zones & Conduits" default-deny flow matrix
- Zero-Trust access - no inbound ports exposed: Cloudflare Tunnel for publication plus a Tailscale / WireGuard overlay to a hardened jump server
- Detection & response - Wazuh SIEM/XDR with Suricata NIDS (Modbus deep-packet inspection), a Conpot ICS honeypot, and YARA hunting for OT malware (FrostyGoop, Industroyer, PIPEDREAM), mapped to MITRE ATT&CK for ICS
- Governance - risk analysis, safety-first incident-response playbooks (human-in-the-loop for any action toward the plant), and NIS2 / Cyber Resilience Act compliance alignment
Purdue Model, IEC 62443, iDMZ, Wazuh, Suricata, Conpot, YARA, Tailscale, Cloudflare Zero Trust, K3s, Modbus/OPC-UA, MITRE ATT&CK for ICS
🔒 Client engagement: full architecture documentation is confidential. → IT/OT security services
Tools I use regularly for security analysis, testing, and automation.
Full Skillset
| Area | Tools |
|---|---|
| Offensive Security | Metasploit, SQLMap, Hydra, John the Ripper, Hashcat, Gobuster, ffuf, Nikto, Nuclei, WPScan, Aircrack-ng, pwntools, LinPEAS |
| Defensive / SIEM | Splunk, Wazuh, Snort, Suricata, Nessus, OpenVAS, Grafana, Loki, Promtail |
| Networking & Recon | Cisco (CCNA), Wireshark, Nmap, Netcat, Shodan, Maltego, Tor |
| Development | Python, C, C++, Java, Bash, PowerShell, LaTeX |
| Cloud & Infrastructure | Docker, Kubernetes, AWS, Azure, GCP, Terraform, GitHub Actions, VMware, VirtualBox |
| Web Technologies | HTML/CSS, JavaScript, TypeScript, React, PHP, Laravel, Node.js, Nginx, Apache |
| OS | Kali Linux, Ubuntu, Debian, Windows, macOS, Raspberry Pi OS |
