Entry-Level SOC Analyst | CompTIA Security+ & Network+

I am building practical Blue Team experience through hands-on SOC investigations in a controlled lab environment. My projects focus on detecting, investigating, and correlating suspicious activity across network and endpoint telemetry using tools such as Security Onion, Zeek, Suricata, Elastic, Sysmon, and Windows Event Logs.

My goal is to begin my career in a SOC / Blue Team role where I can continue developing in alert triage, threat investigation, detection engineering, and incident response. Alongside cybersecurity, I am also developing practical skills in AI and automation, with a focus on using modern AI tools effectively in technical workflows.

• CompTIA Security+ — Verified by CompTIA via Credly
• CompTIA Network+ — Verified by CompTIA via Credly

Security Monitoring & SIEM

• Security Onion
• Elastic / Kibana
• Alert triage and investigation
• Timeline reconstruction
• Network and endpoint telemetry correlation

Network Security

• Zeek
• Suricata
• DNS and HTTP traffic analysis
• Network reconnaissance detection
• Suspicious C2 / exfiltration investigation

Endpoint & Windows Security

• Windows Event Logs
• Sysmon
• Elastic Endpoint
• PowerShell investigation
• Process tree and command-line analysis
• Windows authentication event analysis

Detection & Analysis

• Sigma
• Suricata rules
• MITRE ATT&CK mapping
• IOC analysis
• Behavioral investigation

Systems & Lab

• Windows
• Linux / Kali Linux
• VirtualBox
• Isolated cybersecurity lab environments

AI & Automation — Developing

• Generative AI and LLM-assisted workflows
• Prompt engineering
• Workflow automation fundamentals
• Applying AI tools to technical research, analysis, and productivity

Investigated a simulated suspicious PowerShell download and execution chain using Security Onion, Zeek, Suricata, Elastic Endpoint, Windows telemetry, and Sigma.

Key work included:

• Correlating endpoint process activity with HTTP and network evidence
• Reconstructing the execution chain from explorer.exe to powershell.exe
• Comparing network-observed and endpoint file hashes
• Identifying the difference between available telemetry and dedicated detection coverage
• Documenting observables, investigation findings, and analyst conclusions

Investigated abnormal DNS activity designed to simulate command-and-control and data-exfiltration behavior.

Key work included:

• Hunting DNS telemetry in Security Onion
• Identifying unusually long and suspicious subdomain queries
• Comparing suspicious activity against normal DNS baselines
• Investigating query patterns, frequency, and destination behavior
• Mapping findings to relevant MITRE ATT&CK techniques

Investigated suspicious PowerShell activity using Windows endpoint telemetry.

Key work included:

• Analyzing PowerShell Script Block Logging (Event ID 4104)
• Investigating process creation through Windows Event ID 4688 and Sysmon Event ID 1
• Reviewing encoded PowerShell and suspicious command-line activity
• Reconstructing parent/child process relationships
• Using endpoint evidence to investigate activity that did not initially generate a network alert

Investigated repeated failed Windows authentication attempts in a controlled SOC lab.

Key work included:

• Analyzing Windows Security Event ID 4625
• Distinguishing genuine bad-password attempts from NTLM processing errors
• Reviewing network logon activity and authentication telemetry
• Confirming whether successful authentication occurred during the investigation window
• Correlating Windows endpoint evidence with Security Onion telemetry

Investigated internal TCP port reconnaissance using Security Onion.

Key work included:

• Detecting suspicious scanning activity with Suricata
• Using Zeek connection logs to confirm multi-port reconnaissance
• Identifying source and target systems
• Evaluating whether scanning activity was authorized
• Documenting appropriate SOC analyst response and escalation actions

I am continuing to improve my practical skills in:

• SOC alert triage
• Threat hunting
• Detection engineering
• Windows and endpoint telemetry
• Network traffic analysis
• Incident investigation
• SIEM workflows
• AI-assisted technical workflows and automation

I am currently pursuing an entry-level SOC Analyst / Blue Team position where I can apply my networking and security fundamentals alongside the hands-on investigation experience demonstrated in these projects.

I am particularly interested in developing toward SOC L2, threat detection, and security engineering responsibilities over time.