If one of these projects saves you time or improves your workflow, consider starring it — stars help independent software reach the people who need it.

SOC Tier 1 analyst with approximately one year of professional experience and Incident Responder, actively seeking opportunities in international cybersecurity environments.

My work spans alert triage, incident investigation, log analysis, and detection rule tuning across multiple SIEM and SOAR platforms. I complement my professional experience with a strong certification stack and a portfolio of self-built detection engineering projects covering malware triage, phishing analysis, brute force detection, and network traffic forensics.

I hold internationally recognised certifications — CompTIA Security+, CySA+, Microsoft SC-200, BTL1, and English C1 (Trinity ISE III) — specialising in cloud-native SOC operations and blue team techniques.

I am open to a wide range of roles across the cybersecurity spectrum: SOC analyst, incident responder, cybersecurity analyst, threat intelligence analyst, detection engineer, and beyond. My goal is to work with serious, driven teams in international environments — wherever the most impactful security work is happening.

• 🔍 Expanding detection coverage across KQL (Sentinel) and SPL (Splunk)
• 🌐 Actively pursuing international cybersecurity roles across multiple domains

SOC Analyst — Tier 1 | Italy | ~1 year

• Alert triage and investigation across SIEM and SOAR platforms
• Log analysis and correlation for endpoint and network events
• Detection rule tuning to reduce false positives
• Incident documentation and escalation to Tier 2
• Threat intelligence enrichment using IOC lookup tools
• Playbook execution and automated response workflows

I am open to opportunities across the full cybersecurity operations spectrum:

SOC Analyst · Incident Responder · Cybersecurity Analyst · Detection Engineer · Threat Intelligence Analyst · Blue Team Analyst · Security Engineer · CSIRT Analyst

Personal detection engineering projects built to go beyond day-to-day SOC operations. All repositories include MITRE ATT&CK mapping, evidence screenshots, and analyst write-ups.

Digital forensics timeline reconstruction of a simulated ransomware incident. Correlates process, Prefetch, Registry and filesystem artifacts into one MITRE-mapped timeline, from the initial phishing attachment to mass encryption, with a full incident report (root cause, blast radius, containment, detection gaps).

MITRE → T1566.001 Spearphishing Attachment · T1486 Data Encrypted for Impact · T1490 Inhibit System Recovery

YARA and Sigma detection rules, each validated against synthetic true/false-positive test cases via an automated harness. Sigma rules parsed and converted to real Splunk SPL with pySigma, not just checked for valid YAML.

MITRE → T1059.001 PowerShell · T1490 Inhibit System Recovery · T1547.001 Registry Run Keys

End-to-end SOC lab on Wazuh + OpenSearch. Custom detection rules, agent deployment, log ingestion validation, and full triage workflow from alert to incident report.

MITRE → T1110.001 Password Guessing · T1078 Valid Accounts

Python malware triage combining static hash reputation (VirusTotal API v3) with a MITRE-mapped behavioral scoring engine, closing the blind spot where an unseen/zero-day hash gets misread as clean. Includes a KQL hunt rule for Microsoft Sentinel.

MITRE → T1027 Obfuscated Files · T1204.002 User Execution: Malicious File

Python parser for raw .eml files. Extracts headers, URLs, IPs, and attachment hashes. Flags typosquatting, suspicious TLDs, and urgency language. Enriches IOCs via VirusTotal API.

MITRE → T1566.002 Spearphishing Link · T1078 Valid Accounts

SPL detection rules for brute force patterns in Windows Security Event logs. Includes threshold tuning notes and a Tier 1 analyst triage playbook.

MITRE → T1110.001 Password Guessing · T1110.003 Password Spraying

Python + Scapy PCAP analyzer. Detects port scans, C2 connections on suspicious ports, and flood activity via both fixed-threshold rules and a statistical baseline (z-score) that catches slow floods fixed thresholds structurally miss — with a reproducible side-by-side demo proving it.

MITRE → T1046 Network Service Scanning · T1071 Application Layer Protocol · T1498 Network DoS

Defensive security reference covering DMA attack mechanics, IOMMU/VT-d protections, Kernel DMA Protection, and memory encryption countermeasures.

MITRE → T1200 Hardware Additions

Self-directed builds outside the SOC day job — end-to-end products and automation systems designed, shipped, and run solo.

Windows PC optimization desktop app with reversible performance, gaming, privacy, and maintenance tweaks. Built with Tauri and React, distributed on the Microsoft Store, via winget, and as a native installer. Independently reviewed on MajorGeeks (4.0/5.0) and listed on Softpedia.

Stack → Rust · Tauri · React · TypeScript

Local-first desktop dashboard for social media analytics and account diagnostics across multiple platforms, with a Python/FastAPI backend and a Tauri desktop shell.

Stack → Python · FastAPI · Tauri · Desktop app

"The best defenders think like attackers — and document like defenders."