Jodrick — SOC Analyst

~

SOC AnalystManhattan, New York

SOC analyst specializing in security monitoring, alert triage, and incident response with Splunk, Microsoft Sentinel, Wireshark, and MITRE ATT&CK.

Five years in IT support and cloud infrastructure: Active Directory, Windows and Linux servers, networking, Docker, and CI/CD. I understand how environments are built and operated, which makes it faster to separate a real incident from noise.

~/projects ❯ ls

Status	Name
# detection engineering & security automation
planned	DETECTION_AS_CODE.yml
planned	SOAR_TRIAGE.json
planned	CLOUD_GUARDRAILS.tf
# digital forensics & threat intelligence
planned	DFIR_TIMELINE.img
planned	APT_DOSSIER.md
planned	MALWARE_TO_STIX.py

click a file, or j / k to move

01 / 06

Detection Engineering CI/CD Pipeline

Detection rules treated like code: written, tested, and deployed automatically

TRACKDetection Engineering & Security AutomationSTATUSPLANNED

STACKSigma · YARA · MITRE ATT&CK · GitHub Actions · Splunk / Elastic

## OBJECTIVE

Build a lab pipeline where detection rules live in version control and only reach the SIEM after passing automated checks, the same way application code moves through CI/CD.

## SCOPE

Author a suite of custom Sigma and YARA rules, each mapped to a specific MITRE ATT&CK technique, starting with T1059 (Command and Scripting Interpreter).
Validate rule syntax and metadata automatically on every commit with GitHub Actions.
Deploy passing rules straight to a lab SIEM instance (Splunk or Elastic), with no manual copy and paste.

## WHAT IT WILL DEMONSTRATE

Turning an ATT&CK technique into a testable, reviewable detection.
Detection-as-code practices: version control, peer review, and repeatable deployment.

Planned build. This page will be updated with the repository, write-up, and results as the work is completed.

02 / 06

SOAR Playbook: Automated Alert Triage

Tier-1 and Tier-2 triage handled by an API-driven workflow

TRACKDetection Engineering & Security AutomationSTATUSPLANNED

STACKShuffle or Tines · VirusTotal · Shodan · AbuseIPDB · Active Directory / Entra ID

## OBJECTIVE

Automate the repetitive first steps of indicator triage so analyst time goes to the alerts that need judgment.

## SCOPE

Intercept phishing and endpoint alerts with an API-driven workflow in an open-source SOAR platform (Shuffle or Tines).
Enrich each indicator against VirusTotal, Shodan, and AbuseIPDB.
Query Active Directory / Entra ID for context on the affected user.
Resolve the alert: close benign tickets safely, or automatically isolate the endpoint when the evidence supports it.

## WHAT IT WILL DEMONSTRATE

SOAR playbook design and security API integration.
Triage logic with clear, auditable decision points.

Planned build. This page will be updated with the repository, write-up, and results as the work is completed.

03 / 06

Multi-Cloud Infrastructure Security & Guardrails

A secure cloud architecture defined as code, with policies that block misconfigurations before they ship

TRACKDetection Engineering & Security AutomationSTATUSPLANNED

STACKTerraform · AWS / Azure · Open Policy Agent · AWS Organizations / Azure Policy

## OBJECTIVE

Deploy an enterprise-style cloud environment entirely through Infrastructure as Code, with security requirements enforced automatically rather than by manual review.

## SCOPE

Define the full architecture (AWS or Azure) in Terraform.
Embed automated policy checks with Open Policy Agent or native guardrails (AWS Organizations / Azure Policy).
Enforce strict network isolation, encryption at rest, and least-privilege IAM roles.

## WHAT IT WILL DEMONSTRATE

Cloud security architecture and policy as code.
Catching insecure configurations before deployment instead of after an incident.

Planned build. This page will be updated with the repository, write-up, and results as the work is completed.

04 / 06

Digital Forensics & Root-Cause Reconstruction

A simulated breach investigated end to end, down to a minute-by-minute attacker timeline

TRACKDigital Forensics & Threat IntelligenceSTATUSPLANNED

STACKVolatility · Autopsy / FTK · Isolated sandbox

## OBJECTIVE

Work a realistic compromise the way an incident responder would: from evidence collection to a defensible reconstruction of what happened.

## SCOPE

Simulate a complex breach, such as a ransomware deployment or a web server compromise, in an isolated sandbox.
Analyze memory dumps with Volatility to hunt for code injection and hidden processes.
Examine disk images with Autopsy / FTK to identify persistence mechanisms.
Reconstruct a precise, minute-by-minute timeline of the attacker's lateral movement.

## WHAT IT WILL DEMONSTRATE

Memory and disk forensics.
Root-cause analysis and evidence-based timeline reconstruction.

Planned build. This page will be updated with the repository, write-up, and results as the work is completed.

05 / 06

APT Attribution Dossier & Infrastructure Mapping

A structured investigation into an active threat actor, delivered as a professional intelligence briefing

TRACKDigital Forensics & Threat IntelligenceSTATUSPLANNED

STACKOSINT · Malware sandboxes · Passive DNS · MITRE ATT&CK

## OBJECTIVE

Produce a finished intelligence product of the kind analysts brief to decision-makers.

## SCOPE

Select an established state-sponsored APT or global ransomware group.
Map its historical TTPs, active infrastructure, and primary geographic targets using OSINT repositories, malware sandboxes, and passive DNS.
Package the findings into a comprehensive, professionally formatted intelligence briefing.

## WHAT IT WILL DEMONSTRATE

Structured intelligence research and source evaluation.
Infrastructure pivoting and clear written analysis.

Planned build. This page will be updated with the repository, write-up, and results as the work is completed.

06 / 06

Malware Behavioral Analysis & Threat Data Pipeline

From a detonated sample to shareable, structured threat intelligence

TRACKDigital Forensics & Threat IntelligenceSTATUSPLANNED

STACKCuckoo / CAPE · Python · STIX / TAXII

## OBJECTIVE

Show the full path from raw malware behavior to intelligence that other teams and tools can consume automatically.

## SCOPE

Build a secure dynamic malware analysis sandbox (Cuckoo / CAPE) and execute real-world samples in isolation.
Extract network artifacts, command-and-control (C2) callback patterns, and system modifications.
Write a Python parser that converts the extracted IOCs into formal STIX objects for sharing over TAXII.

## WHAT IT WILL DEMONSTRATE

Dynamic malware analysis and C2 identification.
Threat intelligence automation and data standards (STIX / TAXII).

Planned build. This page will be updated with the repository, write-up, and results as the work is completed.

NORMAL~/projects/DETECTION_AS_CODE.ymlTop

# resume.txt -- experience & education

## EXPERIENCE

CLOUD / INFRASTRUCTURE SUPPORT COMPANY: SYNAPSE SOLUTIONS PVT LTD DATES: 2024.08 -- 2026.02

Deployed and managed cloud and on-prem infrastructure across VPS and Docker

Built CI/CD to automate deployment, monitoring, and recovery of production services

Held uptime through proactive monitoring and fast incident resolution

IT SUPPORT SPECIALIST COMPANY: MURTECH SERVICES GROUP, INC. DATES: 2021.06 -- 2023.08

Resolved hardware, software, and network issues at 95% first-contact resolution across Windows and Linux

Administered Active Directory users, groups, and access policies; endpoint provisioning and imaging

Deployed and configured servers, routers, and firewalls

FOUNDER COMPANY: PROBOTAI DATES: 2022.01 -- PRESENT

AI automation project founded and run end to end -- building, deploying, and operating the stack

## EDUCATION

M.S. INFORMATION TECHNOLOGY MANAGEMENT SCHOOL: WESTERN GOVERNORS UNIVERSITY DATES: 2026 -- 2027 (IN PROGRESS)

B.S. INFORMATION TECHNOLOGY SCHOOL: WESTERN GOVERNORS UNIVERSITY DATES: 2022 -- 2026

NORMAL~/resume.txtTop

~ ❯ cat certs.txt -- 11

Name	Code	Issuer
aws-cloud-practitioner	CLF-C02	Amazon Web Services
azure-fundamentals	AZ-900	Microsoft
cysa-plus	CS0-003	CompTIA
security-plus	SY0-701	CompTIA
network-plus	N10-009	CompTIA
a-plus	220-1101	CompTIA
project-plus	PK0-005	CompTIA
linux-essentials	--	Linux Professional Institute
itil-4-foundation	--	PeopleCert
google-it-support	--	Google
ciw-web-foundations	x3	CIW

~ ❯ cat skills.txt

Cloud: AWS -- Azure -- VPS provisioning -- Docker -- CI/CD -- monitoring
Systems: Linux -- Windows -- Active Directory -- endpoint imaging -- servers
Network: TCP/IP -- DNS -- routers -- firewalls
Security: Splunk -- Microsoft Sentinel -- Wireshark -- MITRE ATT&CK -- log analysis

download resume.pdf

~/blog ❯ ls

Upcoming write-ups. Each one is published after the matching project work is done.

# detection engineering & security automation

upcoming

Stop Triaging Phishing Manually: Building an Open-Source SOAR Pipeline with Tines/Shuffle

A step-by-step technical guide to connecting an email inbox to an open-source SOAR platform through APIs, with code for VirusTotal enrichment and automatically isolating a test endpoint when a file is malicious.

upcoming

Moving from Alerts to Analytics: Implementing a CI/CD Pipeline for Detection Rules

Managing detection rules like code: writing a custom Sigma rule, validating its format with GitHub Actions, and pushing it automatically to Splunk or Elastic.

upcoming

Fighting Alert Fatigue: Practical Frameworks for Baseline Tuning in an Enterprise SOC

A lead-analyst look at the math and methodology for isolating noisy log sources, such as common service accounts, without creating security blind spots.

# digital forensics & threat intelligence

upcoming

Following the Digital Breadcrumbs: Reconstructing an Incident Timeline with Volatility Memory Forensics

A forensic case study: taking a raw memory dump from a compromised machine, uncovering a hidden process injection, and mapping the attacker's actions minute by minute.

upcoming

Decoding Threat Actor Infrastructure: How to Map an Active C2 Server Using Passive DNS

An OSINT investigation showing how an analyst pivots from a single malicious IP address to uncover the wider operational infrastructure behind an APT group.

upcoming

Translating Malware Artifacts into Actionable Threat Intel: A Guide to Building STIX/TAXII Pipelines

Turning behavioral indicators from a malware sandbox run into structured STIX objects, ready for sharing over TAXII with threat-sharing networks.

# security architecture & strategy

upcoming

Zero Trust Is Not a Product: A Practical Engineering Blueprint for Identity-First Security

Cutting through the marketing around Zero Trust with a realistic architecture guide: conditional access policies, continuous device posture checks, and least-privilege identity and access management.