SOC Analyst → Cloud Security Engineer, based in the Philippines 🇵🇭
~3 years in security operations (Microsoft Sentinel, KQL, incident response), now a cloud security engineer. I build more than I monitor, so I'm rebuilding Azure security from the infrastructure up: as code, secured by default, and documented the way a SOC analyst reads an alert.
Microsoft Cybersecurity Architect Portfolio — 9 hands-on Azure projects mapped to 9 Microsoft certs, AZ-900 through SC-100. Each ships with Bicep IaC, a threat model, MITRE-mapped attack scenarios, and proof it works. Five shipped so far:
 01 · Azure Tenant Bootstrap AZ-900 · Bicep · Entra ID · Policy |
 02 · Defender + Sentinel Tour SC-900 · Sentinel · KQL · Defender |
 03 · Hub-and-Spoke VNet AZ-104 · VNet · Bastion · App Service |
 04 · Azure Security Hardening AZ-500 · WAF · Private Endpoint · Key Vault · Defender |
 05 · Sentinel SOC Build-Out SC-200 · Detection-as-Code · Bicep · SOAR |
Next up: Entra ID Zero Trust identity (SC-300).
Cloud / Microsoft
- ✅ SC-200 — Security Operations Analyst
- ✅ AZ-500 — Azure Security Engineer
- ✅ AZ-104 — Azure Administrator
- ✅ SC-900 — Security, Compliance & Identity Fundamentals
- ✅ AZ-900 — Azure Fundamentals
- 🎯 SC-100 — Cybersecurity Architect Expert (capstone target)
Defensive / Blue Team
- ✅ CCDL2 — Certified CyberDefender Level 2 (CyberDefenders)
- ✅ CCDL1 — Certified CyberDefender Level 1 (CyberDefenders)
- ✅ TryHackMe SAL1 — Security Analyst Level 1
- ✅ CompTIA CySA+ — Cybersecurity Analyst
- ✅ CompTIA Security+
Offensive / Red Team
- ✅ eJPT — Junior Penetration Tester (INE)
- ✅ CompTIA PenTest+
Azure · Microsoft Sentinel · Defender XDR · KQL · Detection-as-Code · Bicep · Entra ID · MITRE ATT&CK · Zero Trust
Every project is a full write-up — the problem, the build, attack scenarios, proof, and what broke along the way:
- When a detection won't fire: the bin-boundary blind spot (Project 05)
- Hardening a live app without it losing access to its own secrets (Project 04)
- Designing around Azure regional capacity limits (Project 03)
- Why "connector connected" doesn't mean data is flowing (Project 02)