Enterprise Shield — Secure Enterprise Operations Platform
Independent Project / Cybersecurity / Cloud / Solution Architecture
Designed and built a recruiter-facing enterprise security operations MVP that brings asset inventory, vulnerability management, incident response, remediation, control evidence, audit activity, architecture documentation, and responsible AI triage into one cohesive interface.
Problem or objective
Security and technology teams often need a single view that connects operational risk, remediation ownership, control evidence, architecture decisions, and executive reporting without obscuring which controls are actually implemented versus planned.
Rachel's role
Solution architect and full-stack project designer responsible for requirements, security architecture, threat modeling, data model, UI/UX, documentation, testing strategy, GitHub publication, and implementation-status governance.
Process
- 01Requirements and portfolio positioning
- 02Security architecture and trust boundaries
- 03Synthetic data model
- 04Dashboard and operational workflows
- 05NIST-aligned control mapping
- 06Responsible AI triage design
- 07Threat modeling and ADR documentation
- 08Testing and CI
- 09Recruiter-facing documentation and public release
Architecture components
Interface layer
- React
- TanStack Start routing
- Tailwind CSS
- shadcn/ui
Data and validation
- Synthetic data model
- Zod schemas
- Typed domain modules
Security governance
- NIST CSF 2.0 mapping
- NIST SP 800-171 Rev. 3 mapping
- STRIDE threat model
- ADRs
Quality and delivery
- Vitest
- GitHub Actions CI
- Lint, test, production build
Case study
Business problem
Security operations, remediation ownership, architecture decisions, and executive visibility usually live in separate tools. Enterprise Shield connects them in one interface so risk, owner, evidence, and status can be read together.
Architecture approach
The MVP implements the interface and synthetic data layer, while the production target architecture is documented separately: trust zones, RBAC, centralized logging, encryption boundaries, and durable persistence are described as target design rather than shipped controls.
Security governance
- NIST CSF 2.0 and NIST SP 800-171 Rev. 3 control mappings kept as evidence thinking, not compliance claims
- Every control carries an honest implementation status: implemented, partial, or planned
- Synthetic data throughout, including synthetic vulnerability identifiers
- STRIDE threat model and architecture decision records published with the repository
Responsible AI
Triage output is simulated advisory guidance with a confidence indicator and suggested priority. A human reviewer is required for every decision; the system takes no autonomous security action.
Engineering quality
- TypeScript and React with typed domain modules
- Zod validation at data boundaries
- Vitest unit tests, latest verified run green at 16 of 16 passing
- GitHub Actions CI running lint, tests, and a production build
Tools and technologies
- TypeScript
- React
- TanStack Start
- Tailwind CSS
- shadcn/ui
- Zod
- Vitest
- GitHub Actions
Security and ethical considerations
- Synthetic data only; no real vulnerability disclosures or organizational data
- NIST CSF 2.0 and NIST SP 800-171 Rev. 3 mappings are portfolio evidence mappings, not a certification claim
- RBAC, persistent audit storage, managed encryption/KMS, authentication, and external scanner ingestion are clearly identified as partial or planned where not enforced in the MVP
- AI triage is simulated advisory output with mandatory human review; no autonomous security decisions
- Established cryptography and security-service concepts only; no homemade cryptography
- Synthetic vulnerability identifiers are used rather than real CVE identifiers
Outcome
A public, documented portfolio application with a professional GitHub repository, real product screenshots, automated CI, 16 passing tests, and explicit implementation-versus-target-architecture disclosures.
Portfolio MVP using synthetic data. Control mappings demonstrate design and evidence thinking; they are not a certification or claim of production compliance.