Security Operations professional focused on high-fidelity detection engineering and automated incident triage. Specialized in SIEM optimization (Splunk/Elastic) and network telemetry analysis to reduce dwell time. Proven ability to bridge offensive methodology with defensive engineering to secure multi-platform enterprise environments.
| Category | Technologies & Platforms |
|---|---|
| Security Monitoring & Visibility | |
| Network Traffic Analysis (NTA) & IDS/IPS | |
| Detection & Frameworks | |
| Endpoint Security | EDR (Endpoint Detection & Response) |
| Security Orchestration & Scripting | |
| Operating Systems |
Verified CompletionAdvanced Standing: Focus on SIEM, Digital Forensics, & Incident ResponseCandidate (Exam Targeted: May 2026)
| Project Name | Objective | Primary Tools | Outcome | Link |
|---|---|---|---|---|
| Enterprise Home Network Lab | Network Visibility | pfSense, Splunk | Engineered a hardened, segmented architecture with active IDS/IPS monitoring and centralized log aggregation for proactive Threat Hunting. | View Repo |
| Automated Phish Extractor | Triage Automation | Python, APIs | Reduced manual triage latency by automating IOC extraction and threat intelligence enrichment, standardizing Incident Response reports for rapid containment. | View Repo |
| Flipper Zero Hardware Security | Protocol Research | Flipper Zero | Conducted vulnerability research on physical access controls and wireless protocols to document defensive countermeasures against HID/RF attacks. | View Repo |
- Framework Alignment: Mapping all lab detections to MITRE ATT&CK tactics (Initial Access, Persistence, Exfiltration).
- Incident Lifecycle: Following NIST 800-61 r2 for structured Preparation, Detection, and Containment.
- Documentation: Maintaining standardized investigation logs to ensure chain of custody, perform comprehensive Forensics, and deliver clear executive reporting.
Structured standard operating procedures (SOPs) for triage, containment, and eradication.
- Analyst Focus: Phishing Analysis, Ransomware Containment, Brute Force Triage.
Repository of custom vendor-agnostic detection logic and SIEM search patterns.
- Analyst Focus: Sigma rule development, Splunk/Elastic queries, MITRE ATT&CK alignment.
Deep-dive forensic reports mapping attacker kill chains and identifying defensive artifacts.
- Analyst Focus: Timeline reconstruction, log aggregation, and indicator extraction.
Disclaimer: All activities documented in this portfolio are performed in controlled, legal environments for educational purposes.