I come from IT operations for a national retail chain with 320+ stores: building the network for 50+ store openings, running Active Directory, Entra ID and Microsoft 365, and restoring around 100 endpoints during the July 2024 CrowdStrike outage. I worked closely with the security team and want to be on it.
At home I run a segmented lab on Proxmox and OPNsense with its own SIEM and IDS. I use it to practise the full loop a SOC analyst works in: generate the attack, find it in the logs, write the detection, and explain it.
Studying for CompTIA Security+. Heading toward security operations first, then cloud security on Azure.
VLAN-segmented lab on Proxmox with an OPNsense firewall at the edge. Wazuh collects logs from seven agents across servers, the firewall and a laptop, deployed with an Ansible role. Suricata runs as an IDS on edge traffic and feeds its alerts into Wazuh.
Attack a lab Active Directory domain with common techniques, then write and test a Wazuh detection for each one.
Enrich and pre-triage lab IDS alerts with a locally hosted model, orchestrated in n8n, so the data never leaves the network.
[ Two or three sentences: what you did, on what, and what came out of it. Write it for a hiring manager who reads only this card. ]
First post coming soon.
[ One or two sentences: what the post covers and why it is worth reading. ]
| Credential | Domain | Target | Status |
|---|---|---|---|
| CompTIA Security+ | Foundations | 2026 Q4 | In progress |
| Microsoft AZ–900 | Azure fundamentals | 2027 Q1 | Planned |
| HTB CJCA | Red + blue analyst | 2027 Q2 | Planned |
| Microsoft AZ–500 | Azure security engineer | 2027 Q3 | Planned |
| HTB CPTS | Penetration testing | 2028 Q1 | Planned |
| CARTP | Azure red team | 2028 Q3 | Planned |
Open to SOC analyst and security operations roles. Happy to walk through any project above in detail, including what I got wrong the first time.
ENG–NN · [ Type of work, e.g. Detection engineering, Lab build, Threat hunt ]
[ One or two sentences: the single most important result. Plain English, for a manager who reads nothing else. ]
[ What you set out to do, where you started from, and how far it got. ]
[ What you tested or built, and the method you followed, e.g. PTES phases or the ATT&CK techniques covered. ]
[ What the issue is, why it matters, and what an attacker could do with it. ]
Reproduction
# [ step 1 — what this command does ] [ command ] # [ step 2 ] [ command ]
Remediation
[ What the results mean overall, what to fix first, and what you would do next. ]