Security Operations & Network Analysis
I investigate endpoint, network, memory, and Windows event evidence in hands-on labs and projects to reconstruct attack chains, determine scope, and document defensible findings.
A curated set of work showing how I move from raw evidence to scoped findings, defensible conclusions, and documented response actions.
Featured investigation · Network Forensics
Reconstructed covert HTTP-cookie exfiltration from packet evidence, preserving packet order and reversing XOR/Base64 encoding with Wireshark, TShark, and Python.
Investigated simulated ransomware and destructive malware across endpoint, network, memory, and Windows event evidence, expanding scope from one endpoint to four.
Built a segmented SOC lab with Active Directory, Wazuh, Sysmon, and Zeek, then validated endpoint and network telemetry ingestion and adversary-simulation visibility.
Triaged a high-priority IDS alert, identified staging and C2 infrastructure, mapped observed behavior to MITRE ATT&CK, and documented containment and detection actions.
Active certifications and scores, verifiable directly with GIAC.
Verify with GIACThe portfolio is organized around operational security capability. Tools matter where they support evidence collection, investigation, validation, and response.
Alert triage, incident investigation, scope expansion, IOC enrichment, playbooks/runbooks, containment recommendations, incident reporting, MITRE ATT&CK, and PICERL in labs and course simulations.
Wireshark, Zeek, RITA, PCAP analysis, TCP/IP, DNS, HTTP/S, C2 beacon analysis, Volatility 3, Procmon, Regshot, and malware triage.
Wazuh SIEM/XDR, Sysmon, Windows Event Logs, Sigma, Hayabusa, Active Directory lab administration, Sentinel/KQL labs, and Splunk/SPL labs.
Windows Server, Ubuntu/Linux, VMware, network segmentation, AWS security labs, Python, PowerShell, SQL, Git/GitHub, log parsing, and evidence extraction.
My hands-on work spans security operations, network analysis, incident investigation, Windows/Linux infrastructure, and telemetry integration. I focus on reconstructing what happened, determining scope, validating conclusions, and documenting the reasoning clearly.
Background, skills, and education
