About
I am a security operations analyst with approximately four years investigating security alerts in SOC environments. My work includes monitoring and investigating alerts across Microsoft Sentinel, Splunk, IBM QRadar and LogRhythm, and validating threats with EDR and threat-intelligence platforms.
I focus on the details that stop breaches: clean triage, fast escalation, and understanding why an alert fired — not just closing the ticket.
Outside the alert queue, I have developed personal Python IOC enrichment and JavaScript browser-monitoring tools. I am rebuilding offensive-security fundamentals on authorised training platforms while exploring AI-assisted security workflows.
Investigation methodology
My process is to establish alert context, examine parsed fields and raw events, search historical activity, pivot on related entities, enrich indicators, validate the observed security-control outcome, and document a justified assessment. An IOC reputation score alone is not proof of compromise.
Experience includes QRadar AQL, Cortex XSOAR case handling, historical IOC searching, MITRE ATT&CK mapping and incident reporting. Formal threat-hunt leadership, production detection engineering and professional penetration testing are not claimed.
Experience
| Period | Role |
|---|---|
| Sep 2023 – present | SOC Analyst, Ensign InfoSecurity |
| Feb – Aug 2023 | Security Analyst |
| Aug 2022 – Jan 2023 | Security internship |
Certifications and education
- CompTIA CySA+ (Jan 2026)
- Diploma and degree in security / IT networking — UniKL (BCS Security), Politeknik Mersing (Diploma, IT Networking)
In progress: detection engineering portfolio; eJPT is the next hands-on certification on the list.
How I work
- Label everything. Fact, observation, assessment, assumption. The habit that stops a reputation lookup from becoming a verdict.
- Reputation is not evidence. An IP with a bad history is a reason to look, not a conclusion.
- Write it down. A runbook that nobody follows is worse than none; a rule with no false-positive notes is a future outage.
- Automate the repetition, keep the judgement human.
Publication scope
Public notes are personal-lab work or independently reconstructed, generic methodology. Employer and client incident data, telemetry, playbooks and investigation records are excluded.