whoami
Entry-level security operations, with the evidence labeled.
I’m working toward a SOC analyst or IT security role. My background is front-line technical support: diagnosing faults under time pressure, documenting every device that comes through intake, and explaining fixes to people who aren’t technical.
Alongside that I’m studying cybersecurity and spending lab time on the parts of the job I want to do next: security monitoring, threat detection, incident response, threat intelligence and automating the repetitive first steps of triage.
How to read this site
Every skill, project and write-up carries one label, so you can see at a glance what’s been used for real and what’s still in progress.
- Applied
- Used in a job or completed coursework.
- Explored
- Set up or worked through hands-on, not yet documented as a finished project.
- Learning
- Currently studying; not yet used in real work.
- Simulated
- Runs on synthetic data created for demonstration. Not from a real environment.
- Planned
- On the roadmap; nothing to show yet.
Work to look at first
-
SOC automation lab
ExploredA home lab wiring Sysmon telemetry into Wazuh, with Shuffle enriching alerts through VirusTotal and opening cases in TheHive.
-
SOC alert triage dashboard
SimulatedAn in-browser alert queue with filtering, MITRE ATT&CK mapping and a triage panel that explains each disposition. Runs on synthetic alerts.
Building next
- Guided log investigations Step-through scenarios where the reader flags suspicious log lines and checks their reasoning against analyst notes and a Sigma-style rule.
- IOC extractor and defanger Paste a report or email and get the IP addresses, domains, URLs and file hashes pulled out, validated and defanged for safe sharing.
- Python alert-enrichment script A command-line script that reads exported alerts, looks up file hashes, and writes a short triage summary for each one.