SOC Engineer at Zentara. Blue team practitioner specializing in detection engineering, threat intelligence, deception technology, cloud security, and security architecture. I turn threat intel into high-fidelity detections, build deception environments to study adversary behavior, and design resilient security architectures across cloud and hybrid environments.
- Sigma, YARA, and KQL rule development for multi-platform coverage (SIEM, EDR, Cloud)
- MITRE ATT&CK mapping & coverage analysis to prioritize detection gaps
- High-fidelity correlation rules tuned for low false positives
- Detection-as-code pipelines with CI/CD integration
- TI platform integrations (MISP, OpenCTI) for automated enrichment
- Threat actor profiling & campaign tracking
- IOC management & sharing via STIX/TAXII
- Intel-driven detection rule creation and hunting hypotheses
- Honeypot/honeynet deployment & management (Cowrie, Dionaea, T-Pot, custom)
- Deception architecture for lateral movement detection
- Adversary engagement & behavioral analysis in controlled environments
- Canary tokens & breadcrumb placement for early warning
- Cloud-native detection for AWS/Azure/GCP (CloudTrail, GuardDuty, Security Hub, Defender for Cloud)
- Container & Kubernetes runtime security (Falco, Tracee, custom eBPF)
- IaC security scanning & policy-as-code (OPA/Rego, Checkov, tfsec)
- CSPM/CIEM posture management and drift detection
- Zero Trust & defense-in-depth design for hybrid environments
- Security control mapping (NIST 800-53, ISO 27001, CIS Benchmarks)
- Data flow threat modeling (STRIDE, PASTA)
- Secure reference architectures for cloud migration
Wazuh Ambassador | CTF Problem Setter | Blue Team Enthusiast