Press ` to open terminal
Press ` or ESC to close
Cybersecurity Analyst · SIEM/XDR · SOC Operations
Cybersecurity analyst at ECS Fin. I monitor threats, triage alerts, and build detection infrastructure — in production and in the lab.
01 — About
I'm a cybersecurity analyst at ECS Fin, supporting threat monitoring and security operations for production financial systems in a regulated client environment. Day-to-day I triage and investigate alerts across Wazuh SIEM/XDR, perform detection tuning, support incident response, and author SOPs and playbooks used across the team.
Outside work I run a hands-on homelab replicating real SOC workflows — and I build tools like Clawdbot and Velar to sharpen the engineering side.
Tools & Technologies
02 — Infrastructure
03 — Journey
Started with a single VM running Kali Linux — just following tutorials and breaking things. Quickly expanded to a full network with pfSense, VLANs, and a dedicated attack machine.
Kali LinuxpfSenseVMsCompleted the full Google Cybersecurity Professional Certificate on Coursera — solidified fundamentals in threat detection, incident response, network security, and Python automation.
GoogleCourseraPythonDeployed Wazuh across my homelab and built automated response playbooks with Tines. Built Clawdbot — a custom Slack bot that parses JSON alert payloads and fires formatted alert cards to my SOC channel. First time I saw a full detection-to-response pipeline work end-to-end.
WazuhTinesClawdbotSlack APIBuilt structured dashboards and analytical reports in Excel and SQL. Automated reporting workflows, sharpening data analysis and systematic problem-solving skills directly applicable to security operations.
SQLExcelAutomationSupporting cyber threat monitoring and security operations for production financial systems in a regulated client environment. Triaging and investigating alerts across Wazuh SIEM/XDR, performing detection tuning, supporting incident response, authoring SOPs and playbooks, and contributing to CIS benchmark validation and audit readiness.
WazuhSOC OperationsIncident ResponseDetection TuningRegulated Env.Focusing on CISM — Certified Information Security Manager — to deepen the governance, risk, and program management side of security alongside hands-on operational work at ECS Fin.
CISMISACASecurity Management04 — Featured Build
Velar is a complete AI-powered trading system — a FastAPI backend serving real-time data via WebSocket, a multi-tab futuristic dashboard (Chart.js, Orbitron UI), a Congressional trading tracker watching 535 members of Congress, a market sentiment gauge, ML algorithm panel, and a kill switch with a live-trading safety arm. Runs in Docker with one command.
The engineering decisions here map directly to security work: hardened API endpoints, CORS policy, credential management for broker auth, safe defaults (paper mode), and a kill switch for emergency stop — the same risk-first mindset I bring to SOC automation.
05 — Selected Work
End-to-end SOC pipeline — Wazuh detects and forwards alerts as JSON payloads to Tines, which parses fields and triggers automated responses: host isolation, ticket creation, and real-time Slack notifications via Clawdbot, a custom Slack bot I built to deliver formatted alert cards to my SOC channel. Reduced MTTR from hours to seconds.
Segmented homelab with 6 VLANs, pfSense firewall with IDS/IPS, Proxmox hypervisor, and a dedicated attack network — simulating enterprise-grade infrastructure for realistic red/blue team exercises.
Full-scope web application pentest documenting 12 vulnerabilities across the OWASP Top 10. Conducted assessments running Burp Suite on a Windows tablet — demonstrating toolset adaptability across hardware. Delivered exploitation PoCs, CVSS ratings, and remediation guidance.
Simulated full AD environment — ran Kerberoasting, Pass-the-Hash, and BloodHound path discovery offensively, then tuned Splunk detection rules and hardened GPOs on the defensive side.
06 — Practice
07 — Writing
A walkthrough of my homelab architecture — from bare metal to a fully segmented network with SIEM, IDS/IPS, and automated incident response. Everything I wish someone had told me starting out.
HomelabStep-by-step offensive walkthrough of Kerberoasting in a lab AD environment — then flipping to write Splunk detection rules that catch it reliably without alert fatigue.
Active DirectoryHow I connected Wazuh alerts to Tines workflows that auto-classify severity, enrich with threat intel, and push formatted cards to Slack via Clawdbot — all without human intervention.
SOAR08 — Credentials
09 — Testimonials
Coming Soon
A quote from a professor, instructor, or colleague will appear here.
Coming Soon
A quote from a CTF teammate, lab partner, or peer will appear here.
10 — Contact
Currently working as a Cybersecurity Analyst at ECS Fin. Open to conversations about senior SOC, detection engineering, and security consulting roles.