Portfolio CV

LUCA RAMSEYER

Systems · Cybersecurity · Software

I work in security operations and software, with a focus on efficient systems, useful automation, and work that respects people’s time.

Get in touch View work

01 About

Calm, precise work across infrastructure, security, and software.

I work in the Security Operations Center, where I focus on incident response and day-to-day security operations. I also build automation with Azure Functions and Logic Apps to streamline recurring processes and remove unnecessary manual work.

Outside of daily operations, I build open-source tooling for analysts. My most recent project is Raml KQL, a privacy-first desktop app that runs any KQL query against as many Log Analytics and Microsoft Sentinel workspaces and tenants as you need. It gets as close as possible to querying in a Defender multi-tenant organization, without needing one.

I care about efficiency, practical value, and using technology in ways that save time for everyone involved.

02 Focus

Three areas of practice.

Systems

Building structured, dependable systems that reduce friction and support reliable operations.

Cybersecurity

Working in security operations and incident response with a focus on clarity, speed, and resilience.

Software

Building practical software and automation, from Azure Functions and Logic Apps to open-source desktop tools like Raml KQL, to save time and improve consistency.

03 Selected work

Current project.

Raml KQL

Multi-tenant KQL querying, as close to a Microsoft Defender multi-tenant organization (MTO) as it gets, without needing one. Raml KQL is an open-source desktop app that runs any KQL query against as many Azure Log Analytics and Microsoft Sentinel workspaces as you choose, across Entra tenants and signed-in accounts, and merges the results with the tenant and workspace on every row. If your organization already has an MTO, use it; Raml KQL is for the teams that don’t.

Privacy and least privilege are built in, not bolted on. There is no telemetry and no Raml KQL server: queries go straight from your machine to Microsoft with your own delegated permissions, and the app holds no secrets or service principals. Results stay in memory or in an encrypted session cache that is destroyed when the app closes. Extensions are sandboxed and must ask before they get any permission, including network access, and every permission can be revoked. Crash reports are never sent without your consent, and tenant names are aliased on screen so screen sharing stays safe.

Around that sits a VS Code-style editor with schema-aware IntelliSense, charts and exports, and shareable query packs.

Open source, MIT
No telemetry
macOS, Windows, Linux
kql.raml.ch
GitHub repository

04 Experience