EdgeCloudflare Tunnel + Access in front of origin

Artem Khludov

Security Automation Engineer Platforms & agentic systems

View My Automation Stacks Contact Me

Perimeter metrics (sampled)

Zero Trust posture: Cloudflare Tunnel, Access policies, and IdP-backed authentication in front of exposed services; charts aggregate deny/WAF-style events when the metrics API is reachable.
TOTAL ATTACKS
-
UNIQUE IPS
-
COUNTRIES
-
AVG/HOUR
-
ATTACKS TIMELINE
ATTACK TYPES
TOP COUNTRIES
ATTACK TOOLS
TOP ATTACKING IPS // DETAILED ANALYSIS
IP ADDRESS COUNTRY ATTEMPTS ATTACK TYPE TOOL USERS ATTEMPTED LAST SEEN
Loading metrics…

About

Security Automation Engineer based in Los Angeles. I build production-grade automation that reduces manual toil and increases reliability in security and DevSecOps environments.
My main focus is designing multi-layered systems that combine deterministic logic and policy engines (where auditability and security are non-negotiable) with intelligent agentic workflows using LangGraph.
I implement cascade scoring (L0 rule-based → L1 → L2 LLM) to optimize cost and performance, applying heavy models only when they deliver real value.
Hands-on experience includes stealth browser automation with Camoufox + Playwright, local LLM inference (Ollama), strong OPSEC practices, Cloudflare Zero Trust architecture, and Linux systems operations.
I prioritize making automation not only smart, but also observable, secure, and truly production-ready.

Experience

2025 – Present

GHOST_ENGINE – Resilient AI Browser Automation & Decisioning Platform (Independent Project)

  • Designed and built a production-grade agentic browser automation system using Camoufox + Playwright with advanced stealth capabilities, human-like navigation patterns, and resilient session management.
  • Implemented a multi-stage cascade scoring pipeline (L0 rule-based → L1 → L2 LLM) with fail-fast logic and token-efficient gating to optimize performance and cost.
  • Developed LangGraph-orchestrated workflows for complex decisioning, including ROI-based prioritization, tiered routing, and conditional branching.
  • Integrated strong OPSEC and security controls: prompt-injection sanitizer, heuristic scanners, LLM firewall, and hard guardrails implemented in Python to prevent unauthorized actions.
  • Utilized local Ollama (llama3.2-vision) for self-healing UI recovery, selector maintenance, and vision-based diagnostics under dynamic front-end changes.
  • Added full observability layer with structured logging (structlog), Redis queues, deduplication, and operator control plane (Telegram + real-time dashboards).
  • Key Technologies: Python, Playwright, Camoufox, LangGraph, Ollama, Redis, structlog.
2024 – Present

Security Automation Engineer

Self-employed / Independent | Los Angeles, CA

  • Designing and developing a supply chain security automation platform for npm ecosystems, implementing a full pipeline: dependency discovery → lockfile analysis → enrichment from OSV & GitHub Advisory Database → risk scoring → intelligent update decisioning → safe deployment and post-update monitoring.
  • Built deterministic core modules for lockfile parsing, dependency graph construction, diff analysis, parent-path resolution, and policy enforcement (update channels, waiting periods, security-critical vs regular updates).
  • Developed LangGraph-orchestrated workflows combining rule-based logic with agentic layers for malicious package detection, script analysis, tarball inspection, and automated triage decisions.
  • Deployed and secured the entire platform using Cloudflare Zero Trust (Access, Tunnels, and policies) as the primary security perimeter with strict identity-based access controls and no public exposure.
  • Hosted the production instance and real-time observability stack on Oracle Cloud Infrastructure, ensuring secure, performant, and cost-effective operation of the automation services and logging pipeline.
  • Created a live demonstration platform with real-time metrics, structured logging, and event-driven dashboards available at artem-cyber.com.
  • Key Technologies: Python, LangGraph, FastAPI, npm ecosystem (package-lock.json), OSV, GitHub Advisory Database, Cloudflare Zero Trust, Oracle Cloud Infrastructure, structured logging, real-time metrics.
2022 – 2024

Systems & Security Administrator

AntHouse Online Store | Moscow, Russia

  • Hardening & Defense: Managed and secured high-load e-commerce infrastructure (Linux/Nginx), implementing ModSecurity WAF to filter automated bot traffic.
  • Security Baseline: Applied CIS Benchmarks for server hardening, including firewall optimization (iptables/nftables) and access control reviews.
  • Task Automation: Developed a library of Bash scripts for automated backups, log rotation, and basic vulnerability scanning.
  • Incident Monitoring: Analyzed authentication logs to mitigate brute-force attempts and coordinated with networking to block malicious IP ranges.
  • Payment Security: Handled SSL/TLS certificate lifecycle management and hardened REST API endpoints for secure transactions.
2017 – 2022

Managing Director / Founder

LLC Pervozdanniy Construction | Moscow, Russia

  • Operations Management: Founded and led a construction company to $2M+ annual revenue, managing 15+ commercial renovation projects from planning to delivery.
  • Leadership: Orchestrated teams of 20+ specialists, ensuring project deadlines, budget compliance, and rigorous quality control standards.
  • Strategy: Developed internal operational frameworks and documentation standards to maintain efficiency across multiple high-stakes projects.

Tech Arsenal

Orchestration and intelligence — LangGraph-class workflows, multi-agent runtimes; not one-off scripts; security as a pipeline; Zero Trust and IAM as the perimeter. APIs and structured logging where résumés still say "JSON parsing".

Automation Engine — primary strength

  • Workflow Orchestration n8n / Tines / StackStorm
  • AI Orchestration LangGraph / Ollama / Sec-LLM fine-tuning / LLM APIs
  • Custom Engines Python / FastAPI / Boto3 / JSON logic / API orchestration
  • Event-Driven Webhooks / Message Queues / Real-time Signal Processing

DevSecOps Pipeline — the conveyor

  • CI/CD & GitOps GitHub Actions / GitLab CI / ArgoCD
  • Security Gates · SAST / SCA Semgrep / Trivy / Snyk
  • IaC Scanning Checkov / Terrascan
  • Artifact Security Docker hardening / Cosign / Syft / Grype / SBOM

Infrastructure & Cloud — identity & control plane

  • Cloud Platforms AWS IAM, VPC, EKS / GCP / Cloudflare Zero Trust
  • IaC Terraform / OpenTofu / Ansible
  • Orchestration Kubernetes / RBAC / network policies / admission controllers
  • Policy as Code OPA / Kyverno

Stealth & Intelligence — key differentiator

  • Antidetect Stack Playwright Stealth / Camoufox / fingerprint spoofing
  • Evasion Techniques JA3 / TLS fingerprint evasion / Canvas & WebGL obfuscation / residential proxies
  • Data Intelligence Custom OSINT Engines / Threat Intel Harvesters / Automated Data Extraction

Runtime & Observability — inside the box

  • Deep Visibility Tetragon, Falco / Sysmon
  • Log Analysis Elastic Stack / Splunk / Grafana Loki
  • Hardening Linux Internals / AppArmor / SELinux / Hardened Kernels

Core Stack — language layer

  • Languages Python / Bash
  • Version Control Git / GitOps
  • Networking mTLS / OAuth2 / OIDC / TCP/IP

Projects

Link to my GitHub Access repositories for security engineering and automation

Problem

SOC team was drowning in 500+ daily alerts. Triage took 15 mins per alert.

Solution

Built an autonomous pipeline. Splunk forwards alerts via Webhook. The automation layer parses JSON, checks IP reputation (VirusTotal API), and blocks malicious IPs on Cloudflare WAF automatically.

Impact

Triage time reduced by 70%. False positives handled without human interaction.

Technical Details

  • Automated alert correlation and prioritization
  • Real-time threat intelligence enrichment via API
  • ChatOps integration (Telegram) for incident notifications
  • Custom Python modules for log parsing and IOC extraction

Open a project card to load its data-flow diagram (SVG).

Open a project to browse its read-only source tree.

Splunk Alert Dashboard

Workflow execution

Cloudflare WAF Block Logs

Education

B.S. in Applied Informatics

Southwest State University (SWSU), Russia

2012 – 2016

Bachelor’s degree. Focus: Information Systems Architecture, Network Security, and Automated Data Processing.

  • Core Systems Knowledge: Gained a foundational understanding of how complex information systems are built and managed, from database design to network protocols.
  • Applied Cybersecurity: Studied the intersection of data analysis and system protection, focusing on building resilient IT operations.
  • Engineering Mindset: Developed the logical framework for orchestrating fragmented software components into unified, automated workflows.

Certifications & Specialized Training

MITRE ATT&CK Defender (MAD) Focus: Detection Engineering, Adversary Emulation, and Threat Mapping.
Splunk Enterprise Security Operations Focus: Advanced SPL, Incident Management, and Security Dashboarding.
CompTIA Security+ (SY0-701) Focus: Infrastructure Security & Risk Management Standards.

Specialized R&D Training

  • Security Automation: Advanced Orchestration with n8n and Event-Driven Python.
  • AI for Cybersecurity: Large Language Model (LLM) Integration for SOC Automation.
  • Stealth & OSINT: Advanced Evasion Techniques and Automated Intelligence Gathering.

Contact

Los Angeles, CA
[email protected]