I am a third-year Computer Science student at Thammasat University with a focus on Blue Team security, threat detection, and incident analysis. I build hands-on security labs that turn raw telemetry into actionable detections, validate alerts through controlled attack simulations, and document the complete incident lifecycle.
- Monitor and investigate endpoint, authentication, and email telemetry.
- Build detection logic with Wazuh and custom correlation rules.
- Map adversary behavior to MITRE ATT&CK and document evidence, severity, response, and remediation.
- Continuously improve through practical labs and incident reports.
- Seeking a Cybersecurity / SOC Internship where I can apply and grow my defensive security skills.
Current direction: Security Operations Center, Blue Team, Detection Engineering, and Threat Hunting.
B.Sc. in Computer Science
Faculty of Science and Technology, Thammasat University
August 2024 - Present | GPAX: 3.40
| Project | What I Built and Validated | Security Stack |
|---|---|---|
| Wazuh Phishing Detection Lab | Deployed a multi-host SIEM lab, collected Postfix telemetry, created a custom Wazuh Level 10 phishing rule, investigated the alert, and mapped the activity to MITRE ATT&CK T1566.002. | Wazuh, Postfix, Ubuntu, Kali Linux, MITRE ATT&CK |
| SSH Brute-Force Incident Investigation | Investigated repeated SSH failures followed by successful unauthorized access. Analyzed Linux authentication logs, classified the case as a high-severity true positive, mapped T1110 and T1078, and produced a formal SOC incident report with containment and remediation steps. | Linux, OpenSSH, Log Analysis, Incident Response, MITRE ATT&CK |
Every project follows the evidence from its source to a defensible decision, documented response, and detection-tuning opportunity.
|
CSTU Summer Cyber Camp 2026 – Cybersecurity & SOC Foundation Department of Computer Science, Faculty of Science and Technology, Thammasat University Completed hands-on training in security operations, Linux, networking, web security, and digital forensics. View Certificate ↗ |
|
AWS Academy Graduate - Cloud Foundations Amazon Web Services Training and Certification Validated foundational knowledge of AWS Cloud concepts, core services, security, architecture, pricing, and support. Verify on Credly ↗ |
|
Cybersecurity for IT Professional Huawei & AIS Academy Covered security policy design, firewall and NAT configuration, high availability, IPS, PKI, and security incident management. Verify on Credly ↗ |
|
Google Cybersecurity Professional Certificate Google / Coursera Completed nine courses covering networks, Linux, SQL, SIEM, IDS, threat detection, incident response, and Python fundamentals. Verify on Coursera ↗ |
|
Pre Security Learning Path TryHackMe Completed foundational hands-on training in networking, web technologies, operating systems, and cybersecurity fundamentals. View Certificate ↗ |
|
Cyber Warrior Hackathon 2025 - Training Program KMUTT & Cyber Crime Investigation Bureau Completed a cybersecurity training program delivered as part of the Cyber Warrior Hackathon 2025. View Certificate ↗ |
- Thailand Cyber Top Talent 2026: Competed in a national-level team CTF and achieved 4,500+ points across multiple security domains.
- CSTU Summer Cyber Camp 2026: Completed 7+ hands-on labs and solved 8 CTF challenges covering Linux, networking, web security, and digital forensics.
- Digital Fraud Cybersecurity Hackathon: Collaborated on an AI-driven behavioral risk detection framework for adaptive trust evaluation.
- Cyber Warrior Hackathon 2025: Helped design a graph-based prototype for detecting mule-account transaction patterns.
- Higher-fidelity detections with clear assumptions and false-positive analysis.
- Repeatable SOC playbooks for alert triage, investigation, containment, and closure.
- Detection-as-code workflows with testing, version control, and evidence-driven tuning.
- Stronger coverage across identity, endpoint, network, and email telemetry.
- Security automation that reduces repetitive analyst work without removing human judgment.
All attack activity shown in these repositories was performed in isolated, authorized lab environments. Public evidence is sanitized before publication.