SIEM Engineering
Cybersecurity Engineer at PostEx managing enterprise security across 500+ endpoints. Deployed Splunk Enterprise for centralized threat monitoring across local/global networks, core routers, and infrastructure. 40+ MITRE ATT&CK-mapped detection rules — 40% false positive reduction — <2min MTTN. TryHackMe Top 1% • 218 rooms completed • 193-day streak.
Available For:
I’m a Cybersecurity Engineer and Assistant Manager – Data Center at PostEx (fintech/logistics), managing enterprise infrastructure security and cybersecurity operations across a high-stakes financial environment.
My core expertise spans SIEM engineering with Splunk Enterprise, open-source security with Wazuh and Elastic Stack, detection engineering against the MITRE ATT&CK framework, threat hunting, network security monitoring, and full infrastructure security from hypervisor to application layer.
I recently deployed Splunk Enterprise in production at PostEx — aggregating logs from the local network, global WAN, core routers (MikroTik/Cisco), and 500+ infrastructure assets. This gives real-time visibility across the full attack surface.
Outside of work I maintain a TryHackMe Top 1% ranking (218 rooms, 39 badges, 193-day streak) and actively research detection engineering, web application security, and threat hunting.
Quantified results from production deployments and continuous learning.
Production deployments, security engineering labs, and research projects with measurable outcomes.
Multi-SIEM, multi-platform security operations platform: Splunk Enterprise + Wazuh + Elastic Fleet + Security Onion deployed on Proxmox VE via Docker. Unified visibility across 500+ endpoints, 100+ servers, network layer to application layer.
Production Splunk Enterprise deployment at PostEx. Universal Forwarders via GPO/Ansible, router syslog, Windows/Linux log collection, syslog aggregation, 40+ SPL detection rules, custom dashboards, alerting.
Wazuh across 500+ endpoints. Agent management, vulnerability detection, File Integrity Monitoring, compliance monitoring (PCI-DSS, GDPR), endpoint monitoring, active response automation.
Elastic Fleet deployment with Elastic Defend agent across 100+ cross-platform servers. Centralized endpoint security monitoring, EDR capabilities, malware prevention, and Elastic SIEM detection rules.
40+ MITRE ATT&CK-mapped detection rules across Splunk SPL, Wazuh XML, and Sigma formats. 40% false positive reduction through systematic audit-mode tuning methodology.
Network security monitoring with Suricata IDS, Zeek protocol analysis, JA3/JA3S TLS fingerprinting for encrypted C2 detection, and Elastic Security integration.
Fully containerized SOC stack: Wazuh + ELK + TheHive + Cortex + MISP via Docker Compose. Full deployment in 15 minutes on any Linux host. Includes MISP threat intel integration.
OWASP Top 10 penetration testing methodology. SQLi, IDOR, SSRF, auth bypass, business logic testing using Burp Suite Pro. Findings directly feed detection rule pipeline.
Production-grade Proxmox VE home lab with VLAN segmentation, Active Directory domain, full SIEM stack, Kali Linux attack simulation, and Security Onion NSM for continuous research.
Automated reconnaissance pipeline: Subfinder + Amass + httprobe + gowitness + Nuclei. Continuous asset discovery, live host monitoring, automated vulnerability scanning.
Published detection content, SPL queries, Sigma rules, and threat hunting playbooks.
Production-tested SPL queries for brute force (T1110), scheduled task persistence (T1053.005), lateral movement via RDP (T1021.001), LOLBin execution (T1218), and DNS tunneling (T1071.004). Deployed across PostEx SIEM.
index=windows_security EventCode=4625
| bucket _time span=5m
| stats count by _time, IpAddress
| where count >= 10
| eval technique="T1110.001"Cross-platform Sigma rules compilable to Splunk SPL, Elastic EQL, QRadar AQL, and Wazuh. Covers PowerShell encoded commands, LSASS memory access, scheduled task creation, and registry persistence techniques.
title: PowerShell Encoded Command
tags: [attack.execution, attack.t1059.001]
detection:
selection:
ScriptBlockText|contains:
- '-EncodedCommand'
level: highHypothesis-driven hunt queries for LOLBin execution, Kerberoasting (T1558.003), DNS tunneling (T1071.004), beaconing detection via connection regularity analysis, and NTDS.dit extraction detection.
index=windows_events EventCode=4688
| eval child=lower(
mvindex(split(NewProcessName,"\\"),-1))
| where child IN (
"mshta.exe","certutil.exe",
"regsvr32.exe","wscript.exe")Elastic EQL and KQL detection rules for Elastic SIEM. Covers process injection (T1055), credential dumping (T1003), privilege escalation, and command & control via Elastic Defend telemetry.
// Elastic EQL - LSASS Access
process where event.action == "start"
and process.name : "lsass.exe"
and process.parent.name != (
"wininit.exe","svchost.exe")Custom Wazuh XML rules for brute force detection, privilege escalation, web application attacks, and active response automation. Rules tuned to minimize false positives in enterprise environments.
<rule id="100001" level="12">
<if_sid>18152</if_sid>
<same_source_ip/>
<occurrence>5</occurrence>
<timeframe>120</timeframe>
</rule>12 full technical articles on SIEM deployment, detection engineering methodology, threat hunting, web application security, network security monitoring, and infrastructure hardening. 1,500–2,500+ words each.
Consistent hands-on practice beyond work hours. Security isn't a 9-to-5.
Alert triage, log analysis, SIEM workflows, escalation procedures, threat intelligence
MITRE ATT&CK coverage, Sigma rules, detection-as-code pipelines, rule validation
SUID/SGID abuse, sudo misconfigurations, kernel exploits, Docker escapes
OWASP Top 10, Burp Suite workflows, API security testing, IDOR and SSRF
Wireshark analysis, Nmap scanning, traffic analysis, firewall bypass techniques
Hypothesis-driven hunting, PEAK methodology, beaconing detection, APT emulation
🔒 Only displaying certifications with verifiable proof. Certifications in progress are not listed.
Open to cybersecurity opportunities, SIEM engineering roles, SOC positions, consulting engagements, and collaboration. Response within 24 hours.