Nessus, Vulnerability Scanning, CVSS Scoring, Risk Prioritization, Threat Intelligence, Attack Surface Reduction, Patch Management Workflows.
Splunk, Wazuh, ELK Stack, Microsoft Sentinel, Microsoft Defender, Sysmon Telemetry, SPL Query Development, Alert Triage Automation.
Wireshark, Nmap, IDS/IPS, Firewalls, VPNs, AWS (EC2), Azure, Azure AD, GCP, IAM Concepts.
MITRE ATT&CK Framework, Incident Response Lifecycle, NIST Risk Concepts, Threat Hunting Methodology.
Python, Bash, Regex, Pandas, Linux (Ubuntu, Kali), Windows Server.
Incident Triage Workflow, Cross-functional Communication, Operational Reporting, Technical Documentation, Executive Risk Summarization.
Summary
Engineered an enterprise-scale cloud SIEM and vulnerability monitoring platform incorporating automated LLM alert triage.
Summary
Constructed a virtualized Security Operations Center (SOC) testbed pairing Wazuh SIEM with Sysmon telemetry to model enterprise threat hunting.
Summary
Developed a high-efficiency forensic parsing script in Python to identify active web exploitation signatures across enterprise server logs.