I triage SIEM alerts, investigate phishing and business email compromise, and turn vulnerability scans into prioritized fixes. Off the clock, I build and break a documented enterprise lab.
$ whoami Security Analyst · SOC · Detection & Response $ cat focus.txt triage Splunk SIEM alerts, 40-50+/day investigate phishing & BEC, IOC analysis assess Nessus / OpenVAS findings analyze Wireshark / Nmap traffic $ ./lab --status [+] pfSense firewall online [+] AD DC fahadlab.local online [+] Kali recon box online [!] Suricata IDS root-caused $
I'm a cybersecurity analyst with hands-on SOC experience across healthcare, client, and multi-tenant environments. My day-to-day has been triaging 40–50+ Splunk SIEM alerts, separating false positives from real threats, investigating phishing and business email compromise, and escalating confirmed compromises with documentation that holds up in an audit.
I also run vulnerability assessments with Nessus and OpenVAS, validate IDS/IPS indicators at the packet level with Wireshark and Nmap, and have hands-on exposure to Azure, AWS, and GCP security. I script in Python, Bash, and PowerShell.
Outside work I keep a fully documented home lab: firewall, attacker box, and an Active Directory domain. I write up every failure and root cause, not just the finished result.
A virtualized lab built from scratch in VirtualBox: pfSense perimeter, Kali attacker, a domain-joined Linux client, and a Windows Server 2025 domain controller. Every step and failure is documented with screenshots.
msinfo32.ipfw divert-socket errorTested 4 independent start paths, edited config.xml directly, and root-caused it to the VirtualBox virtual NIC. Closed as a documented limitation.realm discover found no realmTraced it to systemd-resolved's handling of .local; pointed the resolver at the DC directly.Get-ADDefaultDomainPasswordPolicy.Open-source work built around the problems I deal with during alert triage.
Python CLI that pulls IPs, domains, URLs, emails, hashes and CVEs out of phishing emails and SIEM alerts. It refangs and defangs indicators and exports CSV for Splunk lookups.
$ python ioc_extractor.py alert.txt --defang ipv4 203[.]0[.]113[.]45 domain secure-paymentportal[.]example sha256 9f86d081884c7d65…view repo →
Eight SPL detections covering brute force, password spraying, encoded PowerShell, log clearing, DNS tunneling and more. Each is mapped to MITRE ATT&CK and comes with tuning notes and triage steps.
view repo →End-to-end phishing and BEC investigation: evidence handling, SPF/DKIM/DMARC header analysis, IOC enrichment, scoping, containment, and an incident report template.
view repo →Nine triage playbooks covering authentication attacks, ransomware, EDR alerts, lateral movement, exfiltration, cloud identity and web attacks, plus a severity and escalation matrix, a triage checklist and a log-source cheat sheet.
view repo →Lindsey Wilson University · Jan 2024 – Dec 2025
DEGREEOsmania University · 2019 – 2023
DEGREEGoogle / Coursera
COMPLETEDOpen to SOC Analyst, Security Analyst, MDR, and network security roles, in Kansas City or anywhere I can relocate.