Cloud Security Engineer | Incident Response | Azure & AWS Security
Thanks for stopping by! I've spent the last 7+ years working in SOC operations, SIEM (Azure Sentinel | Splunk | Exabeam), and incident response, helping organizations strengthen their threat detection and response capabilities.
I enjoy exploring threat detection, cloud security, and automation—especially building things that make SOC life easier and more efficient. My current focus is on hands-on projects that bring together real-world investigation, scripting, and cloud monitoring.
My current focus is detection engineering, SOC investigations, and secure Azure infrastructure. I am preparing for Microsoft SC-200.
| Project | What it demonstrates | Validation boundary |
|---|---|---|
| Azure Sentinel threat detection | Three KQL detections, synthetic logs, ATT&CK mappings, false-positive analysis, and a simulated investigation | Local Python reference model tested; live KQL/Sentinel validation pending |
| Secure Azure infrastructure with Terraform | Private endpoints, resource-scoped identity permissions, Key Vault, encryption controls, and diagnostic logging | Mocked Terraform tests passed; no live Azure deployment |
| Python SOC investigation automation | Indicator extraction, offline synthetic enrichment, JSON/Markdown reports, and error handling | 18 local tests passed; no live vendor integrations |
These are personal learning projects using synthetic data. Their results do not represent production deployments or employer/customer environments. Each project includes a walkthrough, test evidence, limitations, and interview notes.
-
SOC Simulation Lab: Building a simulated SOC using Splunk and Security Onion to detect brute-force and privilege escalation attacks, mapped to MITRE ATT&CK.
-
Python Automation for Incident Response: Automating IOC lookups and alert triage using Python — implemented in python-soc-investigation-automation (offline synthetic enrichment, tested reports, no live vendor APIs).
-
Vulnerability Dashboard: Creating Power BI and Python dashboards to analyze CVSS trends, remediation timelines, and SLA compliance.
-
Cloud Security Monitoring: Setting up AWS GuardDuty and Azure Defender for real-time alerting on misconfigurations and policy violations.
SIEM & EDR: Microsoft Sentinel | Splunk | Exabeam | Microsoft Defender | CrowdStrike
Vulnerability Management: Tenable.sc | Qualys | Nessus
Cloud Security: AWS GuardDuty | Security Hub | Microsoft Defender for Cloud | IAM | KMS | CloudTrail
Automation & Scripting: Python | PowerShell | Bash | Logic Apps
Frameworks & Compliance: NIST 800-61 | MITRE ATT&CK | ISO 27001 | SOC 2 | HIPAA
-
Reduced false positives by 25% and improved SOC efficiency through optimized Sentinel correlation rules.
-
Built playbooks for phishing and malware response that cut triage time by 40%.
-
Supported ISO 27001 and SOC 2 audit readiness through evidence mapping and incident documentation.
"Security isn't a checkbox — it's a mindset of learning, adapting, and staying one step ahead."