Aaron SawitSecurity engineer · Singapore

Security engineer · Singapore · GCIH

Somewhere in the logs is one line that explains it. I find that line.

case 2026-09-07 · three GPU services downfrom my incident notes, trimmed
  1. 15:51:55causesystemd[1]: Reloading finished in 623 ms.
  2. 15:54:31symptomjellyfin: FFmpeg exited with code 187
  3. 15:54:31symptomffmpeg: cuInit(0) failed -> CUDA_ERROR_NO_DEVICE
  4. 15:56:01symptomimmich_ml: Failed to initialize NVML: Unknown Error
  5. 15:57:00symptomllm: Failed to initialize NVML: Unknown Error
  6. 15:57:02host: nvidia-smi reports both GPUs healthy

Everyone reads the red lines. The answer was the routine one above them. Read the case

Role
Security engineer, blue team background
Focus
Detection, security engineering and the infrastructure underneath
Based in
Singapore
Credentials
GCIH · BSc Computer Science, first class · TISC CTF Level 5
Evidence
4 case studies, 7 root-cause write-ups, 4 tested detections
Read my CV Email me

What they said. What it was.

Seven problems from systems I run, each traced to one named cause and written up so the next person searching the error finds the fix.

the symptom, as reportedthe root cause

  1. 10 Sept 2026 A per-minute request cap let through several times the cap. KV reads are cached for a minute. A stale counter cannot enforce a window.
  2. 9 Sept 2026 Ad blocking stopped on one phone. The filter logged nothing. iCloud Private Relay resolves names through Apple, so the filter was never asked.
  3. 8 Sept 2026 One TV channel played everywhere except my media server. ffmpeg 7.1 refuses video segments whose URL has no file extension.
  4. 7 Sept 2026 Three GPU services died at the same minute and nothing logged an error. A systemd reload wiped device rules Docker never knew about.
  5. 6 Sept 2026 The emulator rejected every disc image I dumped. Full dumps put the game partition at 0x18310000. The emulator reads 0x10000.
  6. 5 Sept 2026 Game streams worked but looked soft and lagged. The encoder was built without this GPU's kernels and silently fell back to the CPU.
  7. 30 Aug 2026 A 35B model ran at 46 tokens a second. Was that the hardware? No. Runtime and four defaults. 71 tokens a second on the same cards.

All 13 write-ups, including blue team and lab notes

Work

Things I designed, built and keep running. Each has a case study with the decisions and the mistakes.

  1. Product suite, solo

    Versed

    Four free learning tools for students, tutors and teachers, designed, built and run by one person on Cloudflare's edge. No sign-up to play, no tracking, no budget.

    • 4 products live
    • 0 accounts needed to play
    • 1 person: design, code, ops
    Versed Study home page showing a pixel-art cat cafe study room

  2. Infrastructure, self-hosted

    One box, forty services

    A recycled gaming PC running forty-odd containers for my family: photos, passwords, media, DNS filtering, game streaming and local AI. Reachable from anywhere, with no port open to the internet.

    • 40+ services
    • 0 ports open to the internet
    • 14 days of restorable backups
    phoneanywhere laptophome or away TV boxliving room WireGuard, end to end one server2017 gaming PC · 2 GPUs · 40+ apps DNS filterfor every device VPN exit nodefails closed photos · passwordsdocuments · recipes media serverGPU transcoding game streamingheadless 1080p60 local LLMsacross both GPUs backups · uptime checks · alertsrebuilt from one folder public internet0 open ports blocked

  3. Performance engineering

    Local AI on 2017 hardware

    Getting a 35-billion-parameter model to 66 tokens a second on two GTX 1080 Tis by measuring every assumption, including the ones in the documentation.

    • 46 to 71 tokens a second
    • +44% on the same hardware
    • 1 crash found before it shipped
    Decode speed, tokens per second 35B MoE model · 2× GTX 1080 Ti · same hardware default runtime46 + speculative decoding43net loss quantised cache, 64K42not free tuned, full 32K depth60 tuned, empty context71 48K context passed every check, then crashed. Test at full depth.

  4. Blue team, Python

    Detection tooling

    Small, tested tools from my defensive security practice: a log triage pipeline that pairs rule-based detection with an LLM classifier, a phishing link analyser, and hand-written Snort and iptables rules.

    • 4 Sigma rules, ATT&CK mapped, green in CI
    • 36 offline tests on the triage tool
    • 3 public repositories with passing builds
    Rules decide. The model votes on the rest. 1 parseRFC 5424named errors 2 detectbrute force · cronIOC matches 3 enrichGeoIPindicator context 4 classifyLLM, temp 0strict format sshd: Failed password for root from 203.0.113.5 rule ssh_bruteforce · ioc_hit (Tor exit node) geo NL verdict malicious · confidence 0.95 Off-format model output is discarded, never guessed at.

Smaller builds

Detections

Sigma rules written from things I have investigated. Every rule has events it must match and events it must not, and converts to Splunk and Elastic queries.

RuleATT&CKLog sourceTests
System DLL loaded from a user-writable pathDLL search-order hijacking. Written from a Sysmon lab where a copied calc.exe loaded a planted WININET.dll.T1574.001Sysmon event 74 passing
.NET runtime loaded by a process that is not a .NET hostUnmanaged PowerShell: the CLR injected into a native process so PowerShell runs with no powershell.exe in the process log.T1059.001T1055Sysmon event 73 passing
SSH password brute force from one sourceTen failed passwords from one address in five minutes, as a Sigma correlation rule. Ported from my log triage tool.T1110.001sshd auth log2 passing
Client bypassing the filtering resolver with encrypted DNSA device looks up a DNS-over-HTTPS or Private Relay bootstrap host, after which the resolver stops seeing it. Written after it happened on my own network.T1071.004T1572DNS query log4 passing

Read the rules, the fixtures and the generated queries

Where I fit

Three kinds of work I do well, each backed by something on this site you can open and check.

  • Detection and response

    Log analysis, SIEM work and incident handling. I write detections other people can read and test, and I investigate until there is one named cause.

    Detection tooling

  • Security-minded infrastructure

    Linux, containers, networking and monitoring, run as code with backups I have restored from and a threat model I can explain.

    One box, forty services

  • Shipping secure products

    I take products from a blank page to real users on Cloudflare's edge, and make the privacy and abuse decisions as part of the design.

    Versed

About

I work in cybersecurity full time, and I tutor special needs students on the side. The tutoring is why the Versed tools exist and why they are free: the kids I teach needed calmer, simpler tools than the ones schools pay for, so I built them.

My security training is on the defensive side. I came up through Red Alpha's programme in Singapore, took SANS SEC504 on attacker techniques and incident handling, and worked through Hack The Box's SOC analyst path. I like the part of the job where a vague symptom turns into one specific line in one specific log.

The home server is where I practise that on my own time. It runs on a recycled gaming PC with two GPUs from 2017, which means very little works out of the box, and every fix is a small investigation. The write-ups on this site are those investigations.

Want to talk through a case?

I reply to every email, and I am happy to walk through anything on this site on a call. I also like hearing from teachers who use the Versed tools.

hello@aaronsawit.com CV GitHub LinkedIn