Cyber Security Engineer and L2 SOC analyst. Two years deploying and tuning Darktrace, LogRhythm and CrowdStrike Falcon across a managed SOC - and one project where I built the entire detection chain myself and put a stopwatch on it.
Expertise
Most people in a security operations centre either run the tooling or work the queue. I do both - I commission and tune the detection platforms across a client estate, and I am the analyst who investigates what those same rules escalate. Building the detection and answering for it closes a loop most teams leave open.
Commissioning, tuning and optimising client detection platforms: use-case design against real risk, correlation rule authoring, log source onboarding, and the unglamorous half - driving false positives down until the alert queue means something again.
Qualification and in-depth investigation of escalated alerts under NIST SP 800-61: attack scenario reconstruction, root cause, containment, and a prioritised remediation written so the client's decision-makers can act on it.
Proactive hunting between incidents, adversary profiling against MITRE ATT&CK, and turning intelligence into something operational - detection rules and D3FEND countermeasures rather than a report nobody actions.
Platforms
The first three run in production across client environments, and I hold the vendor certification on each. The rest I deployed and configured myself building the SOC below.
Standards: NIST SP 800-61 · NIST CSF · ISO/IEC 27001 · CIS Controls · OWASP · PCI-DSS
Selected work
Engineering final-year project · Global IT Vision · 2026
Ten components, eight of them open source, segmented behind a Palo Alto NGFW and aligned to the NIST SP 800-61 incident response lifecycle. Detection, enrichment, case management and notification wired into one chain - then validated with two end-to-end MITRE ATT&CK scenarios rather than a dashboard screenshot.
The measurement that mattered was time to a contextualised alert with no human in the loop. Run either scenario below and watch it.
Both scenarios were replayed against the live build - Kali 192.168.10.129 against the DMZ. IP addresses and rule IDs are the real ones from the project.
Threat intelligence · MITRE ATT&CK G0049
A full profile of the Iranian espionage group: tradecraft mapped across the kill chain, three malware families taken apart, and the command-and-control infrastructure characterised.
Intelligence is worth only the detection it produces, so the deliverable was not the report - it was a set of actionable detection rules and the matching MITRE D3FEND countermeasures. Select any technique to see what it looked like in this group's hands.
Backdoor receiving tasking and returning output over DNS queries to attacker-controlled domains.
PowerShell backdoor using a DNS tunnelling channel, with fallback across query types to survive filtering.
Later-generation backdoor that hid its traffic in email and inside image files - steganography as a covert channel.
Offensive engagements, automation and applied cryptography
Experience
Credentials
Weighted towards the blue team, and towards the platforms I actually run. Filter by what you are hiring for.
Education
Contact
I am open to SOC engineer, cyber engineer, incident response, threat hunting, detection engineering and SOC analyst roles.