01
Security operations
SOC work, SIEM tuning, incident response and vulnerability management on real production estates.
ISO 27001 · Sentinel · Defender XDR · VAPT→
Read the case study →
↓ Keep going
What I do
Three things,
one discipline.
Security operations and machine learning are usually treated as separate trades. I work where they meet.
02
Intrusion detection
Network defence and IDS/IDPS, from Suricata gateways to deep-learning detectors.
Suricata · Nmap · UFW · Flask→
03
AI security and research
Adversarial machine learning, hardening detection models against attacks designed to fool them.
PyTorch · ART · CAN bus→
Experience
Sri Lanka · United Kingdom
Production estates, not lab conditions.
2024.11 → 2025.05
Cyber Security Engineer
Union Assurance PLC
I ran production security operations on the Microsoft stack for one of Sri Lanka's largest insurers, and owned the ISO/IEC 27001:2022 programme end to end.
20-25
production alerts triaged a month, first response under 10 minutes
11 of 12
audit findings closed, both criticals included, before certification
1
Sentinel misconfiguration found by pen test, then remediated and renegotiated
Microsoft Sentinel · Defender XDR · SentinelOne · Zscaler ZTNA · Azure · VAPT
2024.02 → 2024.11
Associate Engineer
Lanka Communication Services
Promoted from Trainee Associate Engineer
Sri Lanka's first ISP. I worked a 24/7 shift-based NOC defending the islandwide backbone and the secure VPN services that keep banks and industrial customers connected.
5-10
enterprise VPN services restored daily, inside ISP SLA targets
20% → 100%
DCIM asset coverage, mapping the data centre end to end
Half
of the internal ISO 27001 findings resolved before certification
ISP backbone · MPLS · BGP · VPN · 24/7 NOC · DCIM
2022.07 → 2022.10
Technology Intern
AXYYA Digital
Technical research and documentation across assigned projects. From September 2022 I led the intern group and coordinated tasks across the team.
Selected work
6 projects
Things I actually built.
Research projects, security tooling and the archives I keep. Each one carries the reasoning, not just a screenshot.
Research · in progress2025 →
AdverSec
An MSc dissertation on adversarial training for deep-learning intrusion detection on the Controller Area Network. The attack that breaks the model is also the material you train it on.
CICIoV2024 · 1D-CNN · ART→
Research · in progress2026
Glean
A local-LLM OSINT pipeline that turns scattered recon into one prioritised, provenance-tracked brief. One scan of a low-value domain returns around 960 findings. Collection succeeds; judgment does not.
Python · Ollama · entity resolution · CLI→
Academic · completed2024
NetEAGLE
A Raspberry Pi 5 sits inline with a home's traffic and unifies Nmap, UFW and Suricata behind a deliberately simple mobile app. Protection moves from the endpoint to the gateway.
Flask · Suricata · Firebase · Flutter→
Personal · in progress2026
Domain hygiene audit
A passive Certificate Transparency audit of my own domain surfaced 600+ historical records and a spam-issuance pattern predating my ownership. The work was separating the one actionable line from the noise.
Certificate Transparency · crt.sh · passive DNS→
Personal · published2025
The Meridian
A living archive of antiques, books and historical objects, each documented with provenance, condition and valuation notes. Schema-first, like everything else I keep.
Notion API · Cloudflare Pages→
Personal · published2025
Rampe
A working culinary archive of Sri Lankan home cooking alongside dishes gathered from elsewhere. Effort, diet, heat, occasion, and the story behind each one.
Notion API · Cloudflare Pages→
The Lab · 10 instruments
Things I built to understand how they break.
Ten working instruments across security, machine learning and AI. Each runs entirely in your browser, and each shows the working underneath rather than a verdict you have to take on faith.
CH-3FGSM · PGD
Adversarial examples playground
Draw a digit, add an imperceptible perturbation, and watch the classifier flip while the image looks unchanged.
CH-8CoT · LLMs
Unfaithful reasoning
Add a bias a model is never told about. Its answer moves; its chain of thought never admits why.
CH-1SANS ISC
Live global attack traffic
Which ports the internet is attacking right now, live from a worldwide honeypot network.
Seven more on the bench
A phishing URL inspector, a password strength lab, an IOC extractor, a CAN frame decoder and more.
Research and publications
ORCID 0009-0009-3470-0359
Everything with a number attached.
Nothing Is Magic
Book · in progress
A book on the mathematics behind machine learning, rebuilt from first principles for anyone shut out by the notation. Part 1, linear algebra, is complete at 12 chapters.
DOI 10.5281/zenodo.21541212→
AdverSec
MSc dissertation · in progress
Multi-strategy adversarial training for deep-learning intrusion detection on the CAN bus, evaluated on a strictly de-duplicated CICIoV2024. To be open-sourced and submitted to peer-reviewed venues.
Read the case study→
Glean
Independent research · early development
Measuring faithfulness, prioritisation quality and provenance retention when a small local model synthesises structured, multi-tool OSINT. Existing work evaluates prose; Glean's input is normalised entity records.
github.com/yulangalagoda/glean→
Certifications · 7
Every matrix is a rotation, a stretch, then another rotation. The circle has no choice but to become an ellipse.
Writing · a book in progress
Nothing Is Magic
Machine Learning Mathematics
Book · in progressPart 1 · linear algebra · 12 chaptersDOI 10.5281/zenodo.21541212
Before a symbol appears, there is a picture. Before the picture, there is a problem you can actually feel.
A book on the mathematics behind machine learning, rebuilt from first principles for anyone shut out by the notation. Part 1, linear algebra, is complete at 12 chapters.
About
Where security meets machine learning.
I work at the intersection of cyber security and machine learning. My MSc dissertation explores adversarial training for deep-learning intrusion detection on the Controller Area Network, the nervous system of every modern car, using the CICIoV2024 dataset and techniques from the Adversarial Robustness Toolbox.
Before Plymouth I built NetEAGLE, a Raspberry Pi network gateway combining a Flask API, mobile app, Nmap, UFW and Suricata into a single home-network defender. Earlier still, I served as a Cyber Security Engineer at Union Assurance PLC and an Associate Engineer at Lanka Communications.
When I am not reading papers I am cataloguing antiques in The Meridian, documenting Sri Lankan and global recipes in Rampe, and refining the database that powers this site.
Whether you need an engineer on your team, a collaborator on research, or a consultant on a hard security problem, my inbox is open.