Cybersecurity analyst with 1 year real-world experience in SOC operations, SIEM engineering, and OSINT-driven attack surface analysis. Targeting European security teams with a focus on NIS2-aware risk analysis and actionable threat intelligence.
Full passive OSINT-driven external attack surface assessment of a fictional European logistics company. 10 findings including exposed RDP, missing DMARC, breached credentials, and unauthenticated API. Includes executive summary, threat actor profiles (Cl0p, LockBit, APT28), and NIS2 compliance mapping.
20 production-ready Sigma rules covering ransomware precursors, lateral movement (PsExec, WMI), credential dumping (LSASS), and phishing delivery. Each rule includes MITRE ATT&CK mapping, false positive guidance, and tuning notes for QRadar and Splunk.
Structured IR playbooks for BEC, ransomware, credential stuffing, phishing triage, and data exfiltration. Built around NIST 800-61, with escalation trees, containment actions, and evidence collection checklists.
Article 21 compliance gap analysis for a fictional EU logistics company. Maps existing security controls to NIS2 obligations, identifies gaps in supply chain security, MFA, incident reporting, and third-party risk. Directly relevant to EU companies implementing NIS2 from October 2024.
Building SOC and CTI Capabilities the Right Way. A practical guide to blue team operations — from alert triage through adversary tracking — written from hands-on SOC experience.
ARTICLE · Medium · 2025
Embracing AI Prompt Engineering: A Cybersecurity Professional's Journey
Exploring the integration of generative AI into SOC workflows and the emergence of prompt engineering as a technical security skill.
UPCOMING · Book
Dark Signals: The Blue Team Chronicles
A cybersecurity narrative blending storytelling with Blue Team techniques — bridging technical depth with accessibility for a wider security audience.
UPCOMING · Medium
Exploiting IDOR: Understanding Insecure Direct Object Reference Vulnerabilities
Technical deep-dive on IDOR vulnerabilities in modern web applications — real-world attack vectors, exploitation methodology, and mitigation strategies.
Let's work together.
Open to EU-based roles in EASM, SOC Tier 2, Threat Intelligence, and GRC. Remote or relocation considered.