Cyberdrui.de — a hooded cyber druid holding a hex orb and a laptop
01 / About · Codex & Manifesto

The cyber druid.

Part engineer, part archivist of systems. I keep the old rites — curiosity, patience, a healthy paranoia — and practice them with modern tools.

I write code like incantations and read logs like tea leaves.
The net is a forest. Something is always watching. So do I.

By daylight I move systems forward — architectures, teams, roadmaps — the mundane geometry of getting things done. By lantern-light I tinker: a lab of virtual machines, captured packets, half-finished tools, and questions that only answer themselves at 2 a.m.

What you'll find here is not a résumé. It's a field journal. A record of stations travelled, a shelf of small projects, and a way to reach me if our paths should cross.

Portrait: hooded druid with mirrored aviator sunglasses
02 / Waypoints · The Path to Root

Waypoints along
the path.

Timeline
20XX → present
(reverse chronological)
NOW

Engineering lead & quiet architect

Current station · Senior role · full-time

Steering platform & security-adjacent engineering work across multiple teams. Equal parts roadmap, code review, and keeping the lanterns lit while others sleep. I measure good weeks in fewer pager incidents, not more velocity charts.

Leadership Platform Architecture Mentoring
20XX

Senior engineer & tech lead

Previous chapter · Product engineering

Shipped, scaled, and sometimes mercifully deprecated production systems. Picked up the habits that stuck: pragmatic tests, clear on-call runbooks, and the unglamorous art of boring infrastructure.

Backend Distributed systems On-call
20XX

Software engineer

Mid-level · Full-stack

From feature squad to platform squad. Learned that a good abstraction is worth three bad frameworks, and that most "architecture problems" are really just communication problems wearing a costume.

Full-stack APIs Tooling
20XX

Incident Responder

Security operations · Incident response · On-call

Stood watch while the forest burned. The pager went off at 3 a.m. and it didn't lie — attacker in the network, lateral movement confirmed, kill chain mid-flight. The work: trace the intrusion path, contain the breach, cut the next stage before it landed. Read packet captures like scripture, correlated logs across a dozen systems, and wrote post-mortems that asked the uncomfortable questions. Learned to think like the adversary so I could move faster.

DFIR Threat hunting Kill chain On-call Forensics
20XX

Early years & apprenticeship

First stations · Junior → mid

First production deploys, first post-mortems, first honest 3 a.m. incident. Met mentors who taught me to read traces, write README-s, and never trust a log file without a timestamp.

Foundations Linux Networks
03 / Workbench · Projects & Prototypes

Things I tinker with
after dark.

Small tools, learning rigs, and experiments. Most live on GitHub; some are still half-formed spells I haven't released yet.

Active 2 projects

cyberdrui.de

This journal. Plain HTML, no tracking, hand-tuned glow.

HTML CSS JS
source ↗

Home lab

VM farm for detection engineering and packet captures.

Linux Docker k8s
notes ↗
Shipped 2 projects

Scripts & tools

Shell scripts and Go binaries that solved a real problem once.

Bash Python Go
github ↗

Alert triage bot

Enrichment pipeline that routes SIEM alerts with context before they hit the queue.

Python SIEM
Archived 2 projects

Reading & notes

CVE write-ups, paper notes, talks worth remembering.

Markdown
browse ↗

CTF writeups

Capture-the-flag solutions and technique notes from competition years.

Pwn Reversing Web
04 / Crossroads · Where to Find Me

Where to find me.

No form, no calendar link, no newsletter. Just a handful of coordinates. The druid checks them on his own schedule.

// SITE
cyberdrui.de
this page, updated when the wind changes
// GITHUB
github.com/cyberdruide
tools, dotfiles, occasional experiments
// LOCATION
Germany
UTC+1 · UTC+2 in summer
// TOPICS
Security, platform engineering, quiet architecture
happy to talk shop, slow to reply to recruiters
-----BEGIN PGP PUBLIC KEY BLOCK-----
mQINBGXample0AEA7nK3pTQ8vZrJmW4xLpQs2Fh9RcYdNbM6oUe1VkIyGT
wXsKjHmP5dLqN8aRvCzBe3fUoY7tWnExAiD4hJlMpQrKsVuFgZ2bNcOdP
eT6wXiYjHkLmNoBpQrStUvWxYzAbCdEfGhIjKlMnOpQrStUvWxYzAbCdEf
GhIjKlMnOpQrStUvWxYzAbCdEfGhIjKlMnOpQrStUvWxYzAbCdEfGhIjKl
MnOpQrStUvWxYzAbCdEfGhIjKlMnOpQrStUvWxYzAbCdEfGhIjKlMnOpQr
StUvWxYzAbCdEfGhIjKlMnOpQrStUvWxYzAbCdEfGhIjKlMnOpQrStUvWx
=xK9f
PGP key available on request — placeholder shown above