Telemetry → Detection → Enrichment → Case Management → Automation → Feedback

Name: Abdul Rehman
Role: SOC Analyst | Cybersecurity Analyst | Security Automation Builder
Location: Bengaluru, India 🇮🇳

Primary Focus:
  - SOC Operations & SIEM Monitoring
  - Detection Engineering & Alert Triage
  - Incident Response & Case Workflows
  - AWS Security Monitoring & IAM Automation
  - SOAR Workflows with Wazuh, TheHive, MISP, Cortex, n8n
  - AI-Assisted Security Operations

Current Growth Tracks:
  - Defensive Security Engineering
  - Advanced SOC Operations
  - DevSecOps & Cloud Security
  - AI-Driven Security Operations
  - AI Automation & Agentic Workflows
  - Cybersecurity + AI Practical Lab Roadmap

Approach: Build → Detect → Investigate → Automate → Document → Improve
Philosophy: Automate Everything
Goal: Strengthen security operations through practical automation and AI-assisted workflows
🌐 Open to remote roles & freelance

I’m a hands-on cybersecurity practitioner focused on SOC operations, SIEM monitoring, detection engineering, AWS security, incident response workflows, and open-source security tooling.

My portfolio is built around real lab execution and deep documentation — not just learning tools, but deploying, validating, investigating, automating, documenting, and improving complete technical environments.

Over time, I’ve built and documented work across:

• SOC & SIEM operations
• Wazuh-based monitoring, detection, and alert triage
• TheHive, MISP, Cortex, and n8n-based SOAR workflows
• AWS security monitoring, IAM automation, and secure cloud infrastructure
• Linux security hardening, administration, and troubleshooting
• Incident response simulations, containment workflows, and case documentation
• Python automation, DevSecOps-style validation, and observability workflows
• AI-assisted SOC workflows, GenAI security operations, MCP/RAG learning, and agentic automation experiments
• Data science, machine learning, NLP, and analytics foundations for security-adjacent analysis

I also completed a full-year student internship alongside my cybersecurity studies and continue building a large, structured GitHub portfolio through completed labs, specialist repositories, capstone-style projects, and an active long-term hands-on learning roadmap.

This matrix reflects my portfolio-wide hands-on implementation across SOC operations, SIEM, Linux security, AWS monitoring, incident response, security automation, AI-assisted security workflows, Python engineering, and analytics.

Depth labels are evidence-based and reflect completed repositories, capstones, labs, workflow prototypes, and documented hands-on projects.

• High portfolio depth = repeated implementation across multiple repositories, labs, capstones, and documented workflows
• Strong applied exposure = clear practical project evidence with hands-on implementation and technical documentation
• Growing specialist depth = active specialization supported by recent capstone or repository work
• Applied / growing depth = hands-on projects completed, with continued expansion underway
• Solid working depth = practical foundation with documented labs and ongoing growth

This matrix reflects overall portfolio capability, not one isolated repository — covering:

SOC → Detection → Investigation → Enrichment → Hardening → Monitoring → Automation → Documentation → Continuous Improvement

I am working toward becoming a stronger cybersecurity professional who can improve security operations through defensive engineering, automation, cloud security, and practical AI-assisted workflows.

My long-term direction is to build useful security systems that connect:

• SOC monitoring and detection engineering
• incident response and case workflow discipline
• cloud security, IAM visibility, and DevSecOps-style validation
• Python automation, observability, and evidence-driven reporting
• AI-assisted triage, agentic workflows, MCP/RAG learning, and human-in-the-loop automation

The goal is not to automate everything blindly. The goal is to automate the repetitive, high-context, and evidence-heavy work that can help analysts move faster while keeping security decisions explainable and reviewable.

• Cloud Cyber Security Certificate — Al-Nafi International College (issued Jan 2026)
• EduQual RQF Level 3 Diploma in Cloud Cyber Security — Al-Nafi International College
• Cyber Security Internship — Al-Nafi International College
• CISSP-aligned Training — Al-Nafi International College
• Certified in Cybersecurity (CC) — ISC2
• ISO/IEC 27001:2022 Lead Auditor — Mastermind
• Certified Fundamentals in Cybersecurity — Fortinet

• SOC Analyst & Cybersecurity Job Simulations — Forage (TATA, Deloitte, AIG, Datacom, Telstra, Commonwealth Bank)
• Certified Phishing Prevention Specialist (CPPS) — Hack & Fix
• Certified Threat Intelligence & Governance Analyst (CTIGA) — Red Team Leaders
• Certified Red Team Operations Management (CRTOM) — Red Team Leaders
• Cybersecurity Fundamentals, SOC in Practice, Enterprise Security, Threat Intelligence & Hunting — IBM SkillsBuild

• Hugging Face AI Learning Tracks — Agents Course, LLM Fundamentals, Fundamentals of MCP, MCP for Production Automation
• Anthropic AI Fluency & Claude Learning — AI Fluency, Claude 101, Claude Code 101, Claude Code in Action, Claude Cowork
• Anthropic MCP / Agentic Workflow Certificates — Introduction to MCP, MCP Advanced Topics, Subagents, Agent Skills
• AI Masterclass & Workshops — Dhruv Rathee Academy, GrowthSchool, be10x
• AWS DevOps and Agentic AI Masterclass — Train with Shubham

• Data Analytics Essentials — Cisco Networking Academy
• Introduction to Data Science — Cisco Networking Academy

This section highlights the original SOC / SOAR malware investigation architecture, analyst workflow, and threat-intelligence feedback loop using Wazuh, TheHive, Cortex, MISP, AWS, and Sysmon. The featured capstone table above shows how the portfolio has expanded further into AWS IAM automation, secure AWS infrastructure, GenAI detection-as-code, MCP/RAG security, and agentic AI-assisted security operations.

flowchart LR
  %% =========================================================
  %% SOC + SOAR + TI — End-to-End Workflow (Swimlanes, Boxed)
  %% with stronger lane separators (GitHub Mermaid friendly)
  %% =========================================================

  A_ENR[" "]:::anchor
  A_IR[" "]:::anchor
  A_TI[" "]:::anchor
  A_FB1[" "]:::anchor
  A_FB2[" "]:::anchor

  F1[" "]:::frame
  F2[" "]:::frame
  F3[" "]:::frame
  F4[" "]:::frame
  F5[" "]:::frame
  F6[" "]:::frame

  F1 -.-> F2
  F2 -.-> F3
  F3 -.-> F4
  F4 -.-> F5
  F5 -.-> F6

  subgraph L1[" "]
    direction TB
    H1["🪟 Endpoint"]:::laneHeader
    SIM["🧨 Controlled Attack Simulation<br/>PowerShell • DNS • File Drop • Persistence • Network"]:::stage
    ENDPOINT["Sysmon + Wazuh Agent<br/>Telemetry collection"]:::stage
    H1 --> SIM --> ENDPOINT --> F1
  end

  subgraph L2[" "]
    direction TB
    H2["🛡️ SIEM / XDR (Wazuh)"]:::laneHeader
    WAZ["Wazuh Manager<br/>Rules • Correlation • Alerts"]:::stage
    IDX["Wazuh Indexer<br/>OpenSearch"]:::stage
    WDASH["Wazuh Dashboard<br/>Hunting • Evidence • Discover"]:::stage
    H2 --> WAZ --> IDX --> WDASH --> F2
  end

  subgraph L3[" "]
    direction TB
    H3["👨‍💻 SOC Analyst"]:::laneHeader
    ANALYST["Triage + Investigation<br/>Review ➜ Correlate ➜ Extract IOCs"]:::human
    GATE["Decision Gate<br/>True Positive confirmed?"]:::decision
    H3 --> ANALYST --> GATE --> F3
  end

  subgraph L4[" "]
    direction TB
    H4["🗂️ Case Mgmt + SOAR (TheHive + Cortex)"]:::laneHeader
    THEHIVE["TheHive Case<br/>Alert ➜ Case ➜ Tasks ➜ Timeline"]:::stage
    OBS["Observables / IOCs<br/>Hash • Domain • IP • URL • File • Registry"]:::stage
    CORTEX["Cortex Automation<br/>Analyzers / Responders"]:::stage
    ENR["Enrichment Results<br/>VT • OTX • MISP lookups etc."]:::stage
    MITRE["MITRE ATT&CK Mapping<br/>Evidence ➜ Techniques ➜ TTPs"]:::stage

    H4 --> THEHIVE --> OBS --> A_ENR
    A_ENR --> CORTEX --> ENR --> A_ENR
    ENR --> THEHIVE
    THEHIVE --> MITRE --> A_IR --> F4
  end

  subgraph L5[" "]
    direction TB
    H5["🛠️ Incident Response"]:::laneHeader
    IRFLOW["IR Lifecycle<br/>Identify ➜ Analyze ➜ Contain ➜ Eradicate ➜ Recover ➜ Review"]:::ir
    ACTIONS["Endpoint Actions<br/>Triage • Kill proc • Block C2 • Remove persistence • Export EVTX"]:::action
    CLOSE["Case Closure<br/>Final report • Timeline • Metrics • Lessons learned"]:::outcome

    H5 --> IRFLOW --> ACTIONS --> IRFLOW
    IRFLOW --> CLOSE --> A_TI --> F5
  end

  subgraph L6[" "]
    direction TB
    H6["🧠 Threat Intelligence (MISP)"]:::laneHeader
    MISP["MISP Event<br/>Validated IOCs + Tags + Context"]:::ti
    SHARE["Share / Reuse<br/>Correlation • Community • Future detections"]:::ti
    H6 --> MISP --> SHARE --> F6
  end

  ENDPOINT -->|📤 Sysmon telemetry| WAZ
  WDASH --> ANALYST
  GATE -->|📌 Escalate IOCs + evidence| THEHIVE
  A_IR --> IRFLOW
  A_TI -->|✅ Export validated IOCs| MISP

  SHARE -.-> A_FB1 -.->|♻️ Improve detections| WAZ
  SHARE -.-> A_FB2 -.->|🔍 Faster correlation| WDASH

  OUT["🏁 Outcome<br/>End-to-end SOC workflow + SOAR automation + TI feedback loop"]:::outcome
  CLOSE --> OUT

  classDef laneHeader fill:#0b1220,stroke:#94a3b8,stroke-width:3px,stroke-dasharray: 6 4,color:#e5e7eb;
  classDef stage fill:#111827,stroke:#475569,stroke-width:1px,color:#e5e7eb;
  classDef human fill:#0f172a,stroke:#22c55e,stroke-width:1px,color:#e5e7eb;
  classDef decision fill:#0f172a,stroke:#f59e0b,stroke-width:2px,color:#e5e7eb;
  classDef ir fill:#0f172a,stroke:#60a5fa,stroke-width:1px,color:#e5e7eb;
  classDef action fill:#0f172a,stroke:#ef4444,stroke-width:1px,color:#e5e7eb;
  classDef ti fill:#0f172a,stroke:#a78bfa,stroke-width:1px,color:#e5e7eb;
  classDef outcome fill:#0f172a,stroke:#14b8a6,stroke-width:2px,color:#e5e7eb;

  classDef anchor fill:transparent,stroke:transparent,color:transparent;
  classDef frame fill:transparent,stroke:transparent,color:transparent;

  class A_ENR,A_IR,A_TI,A_FB1,A_FB2 anchor;
  class F1,F2,F3,F4,F5,F6 frame;

  linkStyle 0 stroke:#94a3b8,stroke-width:4px,stroke-dasharray:10 6,opacity:0.95;
  linkStyle 1 stroke:#94a3b8,stroke-width:4px,stroke-dasharray:10 6,opacity:0.95;
  linkStyle 2 stroke:#94a3b8,stroke-width:4px,stroke-dasharray:10 6,opacity:0.95;
  linkStyle 3 stroke:#94a3b8,stroke-width:4px,stroke-dasharray:10 6,opacity:0.95;
  linkStyle 4 stroke:#94a3b8,stroke-width:4px,stroke-dasharray:10 6,opacity:0.95;

🤝✨ Let’s Connect, Collaborate & Build Secure Systems ✨🤝

💼 Professional Services

• 🔍 SOC Monitoring & Alert Triage — Alert review, triage support, escalation notes, and analyst-style reporting.
• 📊 Wazuh SIEM & Detection Support — Log visibility, rule/decoder support, dashboard checks, and detection workflow improvement.
• 🧠 Threat Intelligence & IOC Enrichment — IOC review, enrichment, ATT&CK mapping, and investigation context building.
• 📝 Incident Response Documentation — Case notes, timelines, containment tracking, lessons learned, and response reporting.
• 🐧 Linux Security Hardening — SSH hardening, firewall setup, permissions, audit visibility, and service security checks.
• 🌐 Web & Network Security Visibility — Web logs, WAF visibility, traffic review, Nmap/Wireshark analysis, and monitoring support.
• 🧪 Vulnerability Review & Validation — Finding review, prioritization, hardening recommendations, and remediation documentation.
• 🤖 AI Security Automation & n8n Workflows — Alert-to-case automation, AI-assisted triage, Slack/TheHive routing, and workflow prototyping.
• ⚙️ Python / Bash / DevSecOps Automation — Helper scripts, log parsing, CLI tools, validation checks, and lightweight automation.
• 📚 Technical Documentation & Portfolio Writing — GitHub READMEs, architecture writeups, project documentation, and technical presentation.

📧 Reach Out

🌟 If you find my work interesting, please consider:

---

“In cybersecurity, continuous learning is not optional — it is survival.”
— Bruce Schneier

“A man who builds from scratch never fears loss, because what made him cannot be taken away: knowledge, experience, and resilience.”
— Mastering Manhood

Made with 💙 by Abdul Rehman

_{Last Updated: May 2026}