Martins Akermanis

I designed and built an internal security orchestration platform at a cryptocurrency trading firm using Anthropic's Model Context Protocol (MCP) to connect AI agents directly to security tooling.

The system exposes CrowdStrike Falcon, Elastic Security SIEM, and internal asset inventories as MCP servers, enabling Claude Code agents to autonomously query alerts, correlate indicators across data sources, and draft incident reports.

I also built specialized MCP servers for each security tool: one for endpoint telemetry (CrowdStrike detections, device inventory), one for log correlation (Elastic queries, saved searches, detection rules), and one for asset context (ownership, criticality, network topology).

The orchestration layer routes incoming alerts to the appropriate agent chain encompassing triage, enrichment, and reporting, reducing mean investigation time from 45 minutes to under 12 minutes per alert. The platform also generates weekly executive security briefings by aggregating trends across all connected data sources. It was built entirely in Python with a modular architecture that allows new MCP servers to be added as the security stack evolves.

I built a custom vulnerability management platform that replaced manual Excel-based tracking with an automated, API-driven system at an iGaming company managing over 1,500 devices across multiple countries.

The platform integrates Greenbone (OpenVAS) for vulnerability scanning with Netbox as the single source of truth for asset inventory, automatically enriching each vulnerability finding with asset ownership, business criticality, network zone, and compliance scope (PCI DSS vs general).

I also developed a Python-based GUI orchestration layer that schedules scans by asset group, deduplicates findings across scan cycles, calculates risk scores weighted by asset criticality and exploit availability, and pushes results into Elastic Security for visualization.

In addition, I built Kibana dashboards showing vulnerability trends by business unit, SLA compliance for remediation timelines, and aging reports for overdue findings. I added Ansible playbook integration for one-click remediation of common misconfigurations (expired certificates, weak SSH ciphers, missing patches).

The system reduced the vulnerability management cycle from a two-week manual process to a continuous, near-real-time operation.

I developed a modular phishing simulation framework for a cybersecurity consultancy that automated the entire lifecycle of social engineering engagements—from infrastructure provisioning to campaign execution to evidence collection.

The framework uses Ansible playbooks to provision Azure VMs, configure Postfix mail servers with valid SPF/DKIM/DMARC records, deploy GoPhish with client-specific templates, and set up the Evilginx AiTIM framework for advanced credential-harvesting scenarios.

I built a Python-based template engine that generates phishing emails by combining interchangeable components (configured in YAML files): sender personas, pretexts (IT helpdesk, HR policy, CEO urgent request), and payload types.

Each campaign automatically collects granular metrics and generates a branded PDF report with risk scores for each department.

I also added callback detection to measure which employees reported the phishing attempt through proper channels.

The framework was used in 20+ client engagements, with infrastructure teardown fully automated post-engagement to eliminate operational residue. It reduced the engagement setup from a full day of manual configuration to a single Ansible command, completing in under 10 minutes.