IT professional with 2+ years in desktop support making a deliberate move into cybersecurity. I hold a CompTIA Security+ and have built everything in this portfolio through hands-on labs not just coursework.
My hands-on labs cover the full security operations lifecycle: SIEM deployment, threat detection, vulnerability management, incident response, threat hunting, web application security, cloud IAM, and GRC policy development all built in Azure cloud and on-premises environments.
| 🔵 SOC / Blue Team | Microsoft Sentinel · Defender XDR · KQL · Log Analytics · Alert Triage · Incident Response · Sysmon · DCR |
| 🎯 Threat Hunting | MITRE ATT&CK · Hypothesis-Driven Hunting · IOC Investigation · CISA Advisory Analysis · Threat Intel |
| ⚔️ Offensive Security | Hydra · Metasploit Concepts · Brute Force · Attack Simulation · Kali Linux |
| 🔴 Vulnerability Mgmt | Tenable Nessus · Credentialed Scanning · CVSS Scoring · Remediation Planning · GPO-Based Hardening |
| 🌐 Web App Security | OWASP ZAP · DAST · OWASP Top 10 · Burp Suite Concepts |
| ☁️ Cloud & Identity | Microsoft Azure · Entra ID · RBAC · Azure IAM · Intune · Microsoft 365 · Active Directory |
| 📋 GRC & Compliance | NIST CSF · ISO 27001:2022 · NIST SP 800-63B · HIPAA · Policy Development · Risk Assessment · Playbooks |
| 🖥️ Systems & Networking | Windows Server · Linux · VMware · DNS · DHCP · Firewalls · VLANs · NSG |
| 🛠️ Scripting & Automation | PowerShell · Python Basics |
| Project | What I Did | Tools / Skills | Detailed Report Link |
|---|---|---|---|
| SOC Incident Response Lab | • Deployed Windows Server (victim) and Ubuntu (attacker) VMs; ran Hydra RDP brute force and detected login events via KQL (Event IDs 4624/4625) • Built a custom analytics rule mapped to MITRE T1110; performed full SOC incident response in Defender XDR |
Microsoft Sentinel · Defender XDR · Hydra · KQL · Sysmon · Azure NSG · AMA · DCR · MITRE ATT&CK | 🔗 View Full Report |
| GeoIP Watchlist & Global Attack Map Lab | • Exposed Web01 for ~2 days to collect 4,270+ real-world RDP attacks from global threat actors • Built a KQL workbook using ipv4_lookup() to enrich attacker IPs and render a global heat map |
Microsoft Sentinel · KQL · ipv4_lookup() · Watchlist · Workbook · Defender XDR | 🔗 View Full Report |
| Threat Hunting Lab | • Followed CISA Advisory AA25-141b; simulated LummaC2 execution and ingested Sysmon logs via custom DCR • Ran 5 KQL hunting queries mapped to MITRE ATT&CK; confirmed IOC detection against IP 94.158.244.69 |
Microsoft Sentinel · Sysmon · KQL · CISA AA25-141b · MITRE ATT&CK · PS2EXE · IOC Investigation | 🔗 View Full Report |
| Hybrid Endpoint Monitoring Lab | • Onboarded Windows, Linux, and Azure endpoints into a hybrid SIEM lab via Azure Arc • Built KQL detection rules and triggered and resolved a real incident in Sentinel |
Microsoft Sentinel · Azure Arc · AMA · Log Analytics · KQL · DCR · RBAC | 🔗 View Full Report |
| Honeynet & Live Attack Detection Lab | • Deployed Windows and Linux VMs as honeypots with open NSGs; ingested logs via Log Analytics, DCR, and NSG Flow Logs • Enriched alerts with GeoIP watchlist and confirmed live real-world attack detection using KQL |
Microsoft Sentinel · Azure NSG · SQL Server · Log Analytics · KQL · Defender for Cloud | 🔗 View Full Report |
| Project | What I Did | Tools / Skills | Repo |
|---|---|---|---|
| Nessus Vulnerability Management Lab | • Built an Active Directory lab; deployed Nessus Essentials on Kali Linux and ran credentialed scans with GPO-based access • Remediated SMB Signing (Plugin 57608) via GPO, 7-Zip Critical CVEs, and conducted a web app scan with 18 findings |
Tenable Nessus · Kali Linux · Active Directory · GPO · CVSS · SMB Hardening · Windows Server | 🔗 View Full Report |
| OWASP ZAP — Web App Security Assessment Lab | • Performed a full DAST assessment against testasp.vulnweb.com using OWASP ZAP 2.17.0 • Confirmed SQL Injection, DOM/Reflected XSS, Path Traversal, and Open Redirect across 21 alerts mapped to OWASP Top 10 |
OWASP ZAP · DAST · SQL Injection · XSS · Path Traversal · OWASP Top 10 · Kali Linux | 🔗 View Full Report |
| Project | What I Did | Tools / Skills | Repo |
|---|---|---|---|
| Azure IAM Security Lab | • Provisioned a test user and Security Group in Entra ID; assigned Reader RBAC role and validated least-privilege access • Configured MFA via Microsoft Authenticator and reviewed sign-in logs |
Microsoft Entra ID · Azure RBAC · MFA · Sign-in Logs · Least Privilege | 🔗 View Full Report |
| Azure Cloud — Identity & RBAC Lab | • Provisioned Windows Server via Azure CLI and configured dynamic group membership • Implemented custom RBAC roles for delegated access control |
Azure CLI · Entra ID · Dynamic Groups · RBAC | 🔗 View Full Report |
| Azure Windows VM Administration Lab | • Provisioned a Windows 11 VM in Azure; configured RDP access, user accounts, and RBAC • Performed troubleshooting and decommissioned the environment |
Azure · Windows 11 · RDP · Entra ID · RBAC | 🔗 View Full Report |
| Project | What I Did | Tools / Skills | Repo |
|---|---|---|---|
| Policy and Playbook Development | • Developed a Phishing Incident Response Playbook with severity classification, containment tracks, and HIPAA breach notification procedures • Wrote a Password & Authentication Policy aligned to NIST SP 800-63B, ISO 27001:2022, and NIST CSF |
NIST CSF · ISO 27001:2022 · NIST SP 800-63B · HIPAA · Policy Writing · Incident Playbook · GRC | 🔗 View Full Report |
| Cyber Risk Assessment | • Conducted a full information security risk assessment for a fictional LMS; produced Asset Register, Threat Catalogue, and Risk Scoring Matrix • Delivered a Controls Register (NIST CSF), Risk Treatment Plan, and Risk Register |
NIST CSF · Risk Assessment · Risk Register · Asset Classification · Control Mapping | 🔗 View Full Report |
| Project | What I Did | Tools / Skills | Repo |
|---|---|---|---|
| On-Prem AD, DC, Windows 11 & Linux | • Built a virtualised on-prem network with Windows Server 2022 as Domain Controller • Joined Windows 11 and Kali Linux clients; configured AD DS, DNS, and resolved cross-platform connectivity issues |
VMware · Windows Server 2022 · Active Directory · DNS · Kali Linux · PowerShell | 🔗 View Full Report |
| Enterprise IT Infrastructure Design & Deployment | • Designed and deployed a full enterprise network for a simulated college with AD OU structure, RBAC, and Microsoft 365 integration • Configured a Fortinet firewall and performed end-to-end validation testing |
Active Directory · Microsoft 365 · Fortinet Firewall · RBAC · VLAN | 🔗 View Full Report |
| Simulation | Company | What I Did | Tools / Skills | Repo | Certificate |
|---|---|---|---|---|---|
| Cybersecurity Analyst | Tata | • Assessed an organisation's cybersecurity posture • Provided strategic security advisory recommendations |
Threat Analysis · Risk Reporting · Security Frameworks | — | 🔗 View Full Report |
| Shields Up Cybersecurity | AIG | • Responded to a ransomware threat scenario and assessed vulnerabilities • Drafted an incident response communication |
Incident Response · Vulnerability Assessment · Ransomware Analysis | — | 🔗 View Full Report |
| Cyber Security Management | ANZ Australia | • Investigated phishing emails and analysed PCAP network traffic • Extracted hidden files and recovered Base64-encoded data |
Wireshark · HxD · PCAP Analysis · Base64 Decoding | 🔗 Repo | 🔗 View Full Report |
| Cybersecurity Job Simulation | Mastercard | • Designed a phishing simulation and analysed results to identify vulnerable teams • Created targeted security awareness training |
Phishing Simulation · Security Awareness · Presentation | 🔗 Repo | 🔗 View Full Report |
| Cybersecurity Job Simulation | Telstra | • Triaged a network malware incident and identified affected systems • Drafted a technical mitigation response |
Incident Triage · Network Security · Malware Analysis | — | 🔗 View Full Report |
| Cybersecurity Job Simulation | Datacom | • Investigated APT34 (OILRIG) breach using OSINT and MITRE ATT&CK • Delivered a risk assessment with inherent, current, and target risk ratings |
MITRE ATT&CK · OSINT · NIST · Risk Matrix | 🔗 Repo | 🔗 View Full Report |
| Certification | Issuer | Credential |
|---|---|---|
| CompTIA Security+ | CompTIA | 🔗 Verify |
| Google Cybersecurity Professional Certificate | 🔗 Verify | |
| SC-200: Microsoft Security Operations Analyst | Microsoft (via Udemy) | 🔗 Verify |
