SYS.NAME
:
LIZARD_OS v1.0.0
SYS.AUTH
:
GUEST_ACCESS_GRANTED
SYS.NODE
:
jodrick.com
UPTIME
:
calculating...
TERMINAL
:
TTY0
STATUS
:
200
$ whoami
SOC analyst focused on threat detection, log analysis, and incident response -- Splunk, Microsoft Sentinel, Wireshark, MITRE ATT&CK.
Five years running the infrastructure that generates the alerts: Active Directory, servers, and networking, then cloud and on-prem systems with Docker and CI/CD. An alert is only as readable as your understanding of the system behind it.
CompTIA CySA+ and Security+, AWS and Azure certified -- 11 certifications. B.S. Information Technology (WGU), M.S. IT Management in progress.
Everything I build on my own time runs without someone else's server.
$ cat status.txt
LOCATION
Manhattan, New York
FOCUS
Security operations -- Threat detection -- Incident response
CONTACT
rick.marquinez@gmail.com
OPEN TO WORK -- REMOTE / HYBRID
TIP: ↑↓ arrows to navigate -- type help for commands
$ ls -la /projects/
4 entries -- click filename to expand -- click [OPEN] to read case study
NAMESIZE MODIFIEDDESCRIPTION
--2025Smart-home hub running a local LLM, no cloud
--2025Real-time voice conversion -- synthetic-voice fraud study
340kb2026-07Four-stem browser jam rack -- no backend at all
live2024-2026Storefront I built and operate -- real customers, real payments
$ cat about.md

The thing I keep coming back to is dependency. Most systems people rely on every day quietly require somebody else's server to be reachable, and nobody notices until it is not.

A voice assistant that ships your audio to a datacenter stops working when the uplink drops. A web app that phones home cannot be used on a plane. A storefront that trusts its payment gateway to behave will sell somebody a half-configured order at 2am. These are the same problem wearing different clothes.

I came up through support because I like being the person who figures out what actually broke. Five years of that -- Active Directory, servers, routers, firewalls, then cloud and on-prem infrastructure with Docker and CI/CD -- taught me that the useful skill is not knowing the answer, it is being able to take a system apart while it is running. That is what a SOC runs on: an alert is a system telling you something broke, and somebody has to find out what.

So the projects here are all the same experiment: build the thing so it does not need permission from anyone to keep working. Run the model in the house. Do the DSP on the client. Own the failure path.

rick.marquinez@gmail.com

$ cat resume.txt
EXPERIENCE
CLOUD / INFRASTRUCTURE SUPPORT  COMPANY: SYNAPSE SOLUTIONS PVT LTD  DATES: 2024.08 -- 2026.02
Deployed and managed cloud and on-prem infrastructure across VPS and Docker
Built CI/CD to automate deployment, monitoring, and recovery of production services
Held uptime through proactive monitoring and fast incident resolution
IT SUPPORT SPECIALIST  COMPANY: MURTECH SERVICES GROUP, INC.  DATES: 2021.06 -- 2023.08
Resolved hardware, software, and network issues at 95% first-contact resolution across Windows and Linux
Administered Active Directory users, groups, and access policies; endpoint provisioning and imaging
Deployed and configured servers, routers, and firewalls
FOUNDER  COMPANY: PROBOTAI  DATES: 2022.01 -- PRESENT
AI automation project founded and run end to end -- building, deploying, and operating the stack
EDUCATION
M.S. INFORMATION TECHNOLOGY MANAGEMENT  SCHOOL: WESTERN GOVERNORS UNIVERSITY  DATES: 2026 -- 2027 (IN PROGRESS)
B.S. INFORMATION TECHNOLOGY  SCHOOL: WESTERN GOVERNORS UNIVERSITY  DATES: 2022 -- 2026
CERTIFICATIONS -- 11
aws-cloud-practitionerCLF-C02Amazon Web Services
azure-fundamentalsAZ-900Microsoft
cysa-plusCS0-003CompTIA
security-plusSY0-701CompTIA
network-plusN10-009CompTIA
a-plus220-1101CompTIA
project-plusPK0-005CompTIA
linux-essentials--Linux Professional Institute
itil-4-foundation--PeopleCert
google-it-support--Google
ciw-web-foundationsx3CIW
SKILLS
Cloud: AWS -- Azure -- VPS provisioning -- Docker -- CI/CD -- monitoring
Systems: Linux -- Windows -- Active Directory -- endpoint imaging -- servers
Network: TCP/IP -- DNS -- routers -- firewalls
Security: Splunk -- Microsoft Sentinel -- Wireshark -- MITRE ATT&CK -- log analysis
Build: JavaScript -- Web Audio API -- WooCommerce -- Home Assistant -- Ollama
$ wget resume.pdf
[ DOWNLOAD resume.pdf ]
/ WARDEN.hub
$ cat WARDEN.hub
01 / 04

WARDEN

A smart-home hub that still answers you with the internet unplugged
ROLESolo -- concept, build, operation YEAR2025 PLATFORMSelf-hosted / on-prem
STATUSRUNNING · private -- no public repo
THE PROBLEM

Commercial voice assistants work by shipping audio from inside your house to a datacenter. That is the architecture, not a setting you can switch off.

Two things follow from it. The first is obvious: every request a household makes is processed on somebody else's hardware, under somebody else's retention policy.

The second is the one that actually breaks things. The assistant stops working the moment the uplink does. A light switch that depends on a datacenter being reachable is a worse light switch than the one it replaced.

THE APPROACH

Warden runs the language model locally through Ollama and wires it into Home Assistant as the voice and automation layer. Interpretation happens on hardware in the building.

No audio leaves the premises. No telemetry goes out. The house keeps responding during an outage.

WHY IT MATTERS FOR SOC WORK

This is the same instinct that makes me useful in an incident. Understanding a system well enough to run it yourself -- instead of escalating to a vendor and waiting -- is the difference between a short outage and a long one.

/ DOPPLER.vox
$ cat DOPPLER.vox
02 / 04

DOPPLER

Started as a VRChat toy. Ended as a security lesson I could not unlearn
ROLESolo -- concept, build, analysis YEAR2025 PLATFORMReal-time audio pipeline
STATUSPRIVATE · write-up on request
WHAT IT IS

A real-time voice-conversion pipeline: speech in, a different voice out, fast enough to hold a live conversation.

The engineering problem is latency budgeting. Transcription and synthesis each cost time, and past a certain total the round trip stops feeling like a conversation and starts feeling like a radio call.

THE TURN

What I did not expect was how convincing it got, and how little it cost to get there. A weekend project on consumer hardware produced something that would comfortably pass over a phone call.

So the project changed shape. It became a practical study of synthetic-voice fraud -- the vishing and voice-cloning attacks that show up in the same material as my CySA+ and Security+ work.

Building the attack is the fastest honest way to understand what defending against it requires. It is the piece of my security training I have held in my own hands rather than read about in a courseware module.

/ RANDOM_ACCESS_JAM.wav
$ cat RANDOM_ACCESS_JAM.wav
03 / 04

RANDOM ACCESS JAM

Four stems from four different songs, locked to one grid, entirely in the browser
ROLESolo -- architecture, DSP, UI YEAR2026 PLATFORMWeb / PWA
STATUSOPEN SOURCE -- MIT · github.com/jodrick-marq/random-access-jam
THE MODEL

Most browser DJ apps are two decks and a crossfader. Random Access Jam is a four-position rack instead -- vocals, drums, bass, lead -- and each position is sourced independently from any loaded track.

Vocals from song A over drums from song B over bass from song C, all playing at once, summed rather than blended.

That model is the whole design. It is not "mix between two things," it is "build one thing out of four unrelated things." Which only works if every stem can be made to agree on tempo and key.

THE HARD PART

Every stem is conformed to a master tempo (90-157 BPM) and master key by pitch-preserving time-stretch, done offline through Signalsmith Stretch compiled to WASM -- the project's only vendored dependency. A half/double-time guard keeps extreme ratios from sounding obviously processed.

Timing is a look-ahead scheduler over the bar grid. Loops launch quantized and restart in lockstep on every 16-bar boundary, so nothing drifts over a long session -- which is the failure mode that makes naive Web Audio loopers unusable after a few minutes.

Change the master BPM or key mid-session and every position re-conforms and swaps on the next loop boundary rather than glitching in place. Tempo and key detection are pure JS running in a Worker, so analysis never blocks the audio thread or the UI.

NO BACKEND, DELIBERATELY

The app makes no network calls at runtime. Tracks live in IndexedDB on the user's own machine and never leave it. A service worker keeps the whole thing working offline.

Two demo stem sets are synthesized procedurally on first run via OfflineAudioContext, so it boots straight into a playable cross-track mashup with nothing uploaded and no account.

WHAT I TOOK FROM IT
  • Real-time scheduling is a systems problem, not an audio problem. Look-ahead, drift, and clock authority are the same concerns as any job scheduler.
  • Offline-first is a discipline. Once you decide there is no server, every convenience you would normally push to a backend has to be solved on the client or dropped.
  • Shipping it MIT and public means the architecture has to be legible to someone who is not me.
/ HIDDEN_ALCHEMIST.shop
$ cat HIDDEN_ALCHEMIST.shop
04 / 04

HIDDEN ALCHEMIST

A real store, with real customers, taking real money
ROLESolo -- build & operations YEAR2024 -- 2026 PLATFORMWordPress / WooCommerce
STATUSLIVE · hiddenalchemist.com
WHAT IT IS

An e-commerce platform I built and operate for a niche technical community -- a storefront selling tooling and packs to people who know exactly what they want and get annoyed when a checkout gets in the way.

The centerpiece is a multi-step product configurator written in vanilla JS that drives WooCommerce variation selection, with checkout across Stripe, PayPal, and Google Pay.

THE INTERESTING PROBLEM

Payment buttons must not appear until a configuration is actually valid. Sounds trivial. It is not, because the payment gateway wants control of its own UI and will fight you for it.

It ended up needing two layers: a CSS gate that hides the payment surface until the configurator marks the state ready, plus a JS intercept for the gateway writing inline !important styles of its own.

One layer alone leaves a window where a customer can pay for something they have not finished configuring -- which is a support ticket, a refund, and a lost customer.

WHAT RUNNING IT TAUGHT ME
  • The difference between code that works on my machine and code that has to survive a stranger's checkout at 2am. Nobody files a bug report; they just leave.
  • Operating the thing you built changes how you build. Every shortcut comes back as a support request addressed to you.
  • Payment integration is mostly failure-path design. The happy path is the easy tenth of it.
root@portfolio:~$