|
I am a SOC Analyst (L2) focused on detection engineering, incident investigation, threat hunting, network forensics, security automation, and authorized security validation. My portfolio is built around one rule:
I want a reviewer to be able to inspect the engineering behind the claim—not just read that I know a tool. Core operating domains
|
|
The panel above is generated by this repository, not by a third-party statistics service. A scheduled GitHub Actions workflow queries the GitHub REST API, verifies selected public claims against the flagship project READMEs, and regenerates local SVG assets plus a machine-readable manifest.
Machine-readable evidence: assets/generated/portfolio-manifest.json
The generator has an explicit baseline fallback. If GitHub API collection fails, the output is marked as baseline-backed rather than silently pretending stale information is live.
|
Defensive SOC investigation + detection engineering workbench SentinelForge converts blue-team claims into inspectable engineering: telemetry parsers, a normalized event model, detection-as-code, process correlation, IOC extraction, ATT&CK context, analyst workflows, API/CLI surfaces, testing, and CI.
Reviewer route: README · Architecture · Rules · Tests |
Local-first network forensics + packet investigation workbench PacketScope transforms PCAP / PCAPNG evidence into a structured analyst investigation: hosts, flows, transactions, protocol metadata, findings, evidence slices, analyst state, reports, and investigation pivots.
Reviewer route: README · Architecture · Detections · Tests |
| Capability | SentinelForge | PacketScope | What it demonstrates |
|---|---|---|---|
| Detection engineering | ✅ | ✅ | Behavior translated into repeatable analyst logic |
| Windows / endpoint telemetry | ✅ | — | Event normalization, process relationships, command context |
| Network telemetry | — | ✅ | Protocol-aware traffic and conversation reconstruction |
| IOC extraction | ✅ | ✅ | Investigation pivots and contextualization |
| Correlation | ✅ | ✅ | Relationships rather than isolated raw events |
| ATT&CK context | ✅ | ✅ | Technique-aware analyst framing |
| Analyst workflow | ✅ | ✅ | Findings connected to review and evidence |
| API / CLI engineering | ✅ | ✅ | Automation and integration surfaces |
| Automated testing | ✅ | ✅ | Reproducible engineering rather than presentation-only claims |
| Defensive boundaries | ✅ | ✅ | Explicit limitations and intended use |
| Technical work | Security question | Operational output | Business value |
|---|---|---|---|
| Alert triage | Is this signal meaningful? | Evidence-backed disposition | Reduces analyst noise and missed escalation |
| Detection engineering | What behavior must surface consistently? | Tested rule logic + ATT&CK context | Improves repeatability and visibility |
| Endpoint investigation | What executed and what changed? | Process tree, timeline, persistence evidence | Improves incident scope and containment |
| Network forensics | What crossed the wire? | Conversations, protocol metadata, packet evidence | Clarifies communication and data movement |
| Threat hunting | What may exist without an alert? | Hypothesis-driven pivots and findings | Exposes detection gaps |
| Authorized validation | Does the control resist expected abuse? | Reproducible finding + retest | Converts assumptions into verified assurance |
| Automation | What repetitive work can become deterministic? | Scripts, APIs, CLI workflows, reports | Improves speed and consistency |
|
|
|
TELEMETRY
↓
NORMALIZE + CORRELATE
↓
DETECT + INVESTIGATE
↓
ESTABLISH SCOPE + PRIORITY
↓
ESCALATE / CONTAIN / CLOSE
↓
TUNE DETECTION + HARDEN CONTROL + DOCUMENT + RETEST
The operating goal is not “generate more alerts.” It is reduce uncertainty until a defensible next action is clear.
The credentials stay fully visible. They support the engineering evidence above; they do not replace it.
| Credential | Completed | Credential ID | Domain |
|---|---|---|---|
| Advent of Cyber 2025 | Dec 2025 | THM-EGTUQF4CAI |
Multi-domain Security |
| CTI – CISA JCDC Triage, Fusion and Analysis | Nov 2025 | THM-JVR3U2HPKS |
Cyber Threat Intelligence |
| Security Engineer | Sep 2025 | THM-2MWEFSMO18 |
Security Engineering |
| SOC Level 1 | Sep 2025 | THM-YHFGKSGY28 |
Security Operations |
| SOC Level 2 | Sep 2025 | THM-TH8U8ODRGS |
Advanced SOC Operations |
| Offensive Pentesting | Sep 2025 | THM-O5YB6D7QMZ |
Security Validation |
| Web Fundamentals | Sep 2025 | THM-Y05LJ9JOTY |
Web Security |
| CompTIA PenTest+ Aligned Learning Path | Sep 2025 | THM-JSEWACT2EY |
Penetration Testing |
| Jr Penetration Tester | Sep 2025 | THM-DFCKXEC7AT |
Penetration Testing |
| Red Teaming | Sep 2025 | THM-HEX0VWNFTS |
Adversary Simulation |
| Course / Certificate | Provider | Completed | Domain |
|---|---|---|---|
| CompTIA PenTest+ Ethical Hacking Training | Udemy | Sep 2024 | Penetration Testing |
| SuperMap GIS Solutions for Telecommunications | SuperMap GIS | Nov 2021 | GIS / Telecommunications |
| Fundamentals of Computer Hacking | infySEC | Jun 2021 | Cybersecurity Fundamentals |
| Cyber Security and Ethical Hacking | Georgian Project Andromeda | Oct 2020 | Ethical Hacking |
|
|
|
|
|
| A detection should show why it matched, what evidence supports it, and what the analyst should verify next. | Conclusions should remain traceable to source events, packets, timelines, or reproducible validation steps. | Rules, parsers, detections, and automation should be tested rather than presented as unsupported claims. |
| Public demonstrations should prefer synthetic evidence, local processing, redaction, and bounded collection. | Security tooling should support investigation, detection, evidence handling, remediation, and authorized validation. | Every useful output should lead toward investigate, escalate, contain, tune, harden, document, retest, or close. |
This repository is intentionally designed like a small production system.
config/portfolio.json
│
├── identity + credentials
└── flagship claim definitions
│
▼
scripts/profile_engine.py
│
┌──────────┴──────────┐
▼ ▼
GitHub REST API README verification
│ │
└──────────┬──────────┘
▼
local dark/light SVGs
portfolio-manifest.json
│
▼
README.md
- GitHub REST API version is explicitly pinned to
2026-03-10. - The workflow runs on a timezone-aware Asia/Tbilisi schedule and can also be triggered manually.
- Workflow actions are pinned to full commit SHAs.
GITHUB_TOKENreceives only the repository-content permission needed to commit generated assets.- The workflow never uses
pull_request_target. - The generator uses the Python standard library only—no runtime package-install supply chain.
- Selected public claims are regex-verified against each flagship repository README.
- Unit tests run before the generated profile is committed.
- A validator checks local assets, SVG validity, credential count, duplicate IDs, and required portfolio sections.
- Dependabot is configured for GitHub Actions maintenance.
- CODEOWNERS covers workflow, script, and configuration changes.
make profile # generate from bundled verified baseline
make test # run unit tests
make validate # validate README/assets/credentials
make all # run everythingSee docs/GOD_MODE_ARCHITECTURE.md for the design.
Role → proof stack → flagship projects → credentials → business impact
Detection coverage → analyst workflows → investigation model → operating system → deliverables
Repository architecture → security boundaries → tests → workflow hardening → generated evidence manifest
01 Detection engineering + SIEM rule quality
02 Advanced Windows / endpoint investigation
03 Cyber threat intelligence + IOC contextualization
04 Active Directory security
05 Network forensics + protocol analysis
06 Web application security validation
07 Python / PowerShell security automation
08 Incident reporting + operational playbooks
This GitHub is maintained as a professional security engineering portfolio, not merely a repository collection.
- Public claims should have inspectable evidence wherever possible.
- Offensive techniques are presented only in authorized, defensive, educational, or lab context.
- Production-sensitive data is excluded from public demonstrations.
- Flagship repositories should document architecture, testing, limitations, security scope, and roadmap.
- Synthetic evidence is preferred for demonstrations.
- Self-ratings such as “95% expert” are deliberately avoided.
- Stars and followers are not treated as proof of security engineering quality.
- New portfolio claims should be added to the machine-readable configuration when they can be verified.
