Security Engineer · SOC Analyst
Monitoring, detection & incident response, backed by a software development background.
- 🔎 Security engineer with hands-on SOC experience: SIEM monitoring, detection engineering and incident response
- 🧱 Operate and harden perimeter & endpoint security (FortiGate, F5, Sangfor, Kaspersky) and PAM (Kron)
- 🛠️ I build open-source tools that automate the repetitive parts of SOC and recon work
- 🧪 I write detections as code: Sigma rules with tests, mapped to MITRE ATT&CK
- 🐛 Practice coordinated vulnerability disclosure through official VDP / bug bounty programs
| Project | What it does | Focus |
|---|---|---|
| 🧪 detection-engineering | Sigma detection rules for Linux and web attacks, mapped to MITRE ATT&CK, each tested in CI against attack and benign log samples | Detection engineering · SIEM |
| 🐛 ioc-hunter | Enriches IPs, domains, URLs and hashes via VirusTotal, AbuseIPDB & OTX into one verdict | Threat intel · SOC automation |
| 🔍 logsleuth | Detects brute-force, password spraying, breaches and web attacks in auth/access logs, mapped to MITRE ATT&CK | Blue team · Detection |
| 🎣 phishtriage | Scores .eml files on spoofing, SPF/DKIM/DMARC, URLs, attachments and social engineering |
Email security · Triage |
| 🧬 maltriage | Triages CAPE/Cuckoo sandbox reports into a verdict, MITRE ATT&CK mapping and extracted IOCs | Malware analysis · DFIR |
| 🔑 tokenpeek (live) | Client-side JWT & token security analyzer: decode + flag alg=none, weak HMAC secrets, key injection and sensitive payload data, all in-browser |
Web · AppSec |
| 🛰️ pcapsleuth | Analyzes .pcap/.pcapng captures — flows, DNS/HTTP/TLS, IOCs and MITRE-mapped detections (port scan, C2 beaconing, DNS tunneling, cleartext creds) |
Network forensics · Blue team |
| 🛰️ cyber-recon | Passive-first async recon orchestrator for VDP / bug bounty scopes, with Nuclei and CVE enrichment | Recon · Attack surface |
Everything is tested in CI: the tools are Python CLIs with pytest suites and automation-friendly exit codes; the detection rules are checked against attack and benign samples.
SIEM & detection
Network, perimeter & access
Offensive & analysis
Threat intelligence
Programming
- Certified Associate on Stellar Cyber for SOC Analyst, Stellar Cyber Essentials Associate (Stellar Cyber)
- Ethical Hacking Essentials, Network Defense Essentials (EC-Council)
- Fundamentals of Dark Web (SOCRadar)
- Red Team Fundamental, Burp Suite for Beginner, Classical Cryptography, Intro to Information Security (Cyber Academy Indonesia)
Full list, projects and research write-ups: defamp.github.io
⚖️ All security testing I do is limited to authorized targets and official disclosure programs.