Threat intel and SOC
- MITRE ATT&CK (Enterprise and ICS)
- SIEM rule tuning
- Splunk
- Wazuh, EDR
- Log analysis
- Incident response (NIST SP 800-61)
- Threat feeds: ThreatFox, URLhaus
Shown in
Signal through the noise
SOC Analyst
I turn raw packets, malware and threat feeds into decisions a SOC can act on.
- First ClassHonours · BSc Cyber Security, DMU, 2026
- 10Case studies · 8 with public repos
- 9,000+IOCs ingested from ThreatFox · stored count, Oct 2026
- OfflineAI analysis · local models via Ollama
Work
Each one is written up like an engagement report: the problem, what I did, the evidence, the result and how it was measured, and the limitations.
WalSec A-TIOC Hub
A privacy-first SIEM-Lite that fuses network forensics with local LLMs
The platform’s pipeline: one lit cell per part, brighter as data moves from the threat feeds and PCAP uploads to the analyst’s screen. Penetration testing and malware investigations
Black-box pentest + multi-sample malware reverse engineering
96 Nessus findings on the lab host, one cell each. Brighter is more severe: 2 critical, 15 high, 26 medium, 8 low and 45 informational. Network forensics and ICS security
Reconstructing a multi-stage SCADA attack from packets
The 9 ATT&CK techniques mapped, one cell each, stepping along the lattice in the report’s order: 7 Enterprise, then the 2 ICS techniques, brightest. Incident response maturity and threat intel
A SIM3 maturity assessment and STIX threat-intel structuring for a logistics SME
The 45 SIM3 parameters assessed, one row per domain: organisation, human, tools, process. Lit: the 8 at or above ENISA Basic. AI-driven phishing detection
Phishing detection on 235,795 URLs, with a leakage fix, a SOC cost model and a poisoning test
PhiUSIIL’s 235,795 URLs at one cell per 1,000. Lit: the 43% that are phishing. FreightDesk, a secure business application
A hardened Flask logistics portal with live FX, RBAC and a full security self-assessment
The OWASP Top 10 (2021), A01 to A10, one cell each. Lit: the 7 with an automated test. Dim: A06, covered by pinned dependencies, and A07 and A09, shown in code. Secure password manager in C++
An AES-256-GCM credential vault in modern C++ built on real OpenSSL crypto
A fresh random 96-bit IV on every save, one cell per bit. The pattern here is drawn at random each time, as the IV is. Cryptography and encryption
Cipher design, RSA cryptanalysis and protocol attack simulation
The cipher’s 30-symbol alphabet, one cell each. Brightness shows where f(x) = (7x + 4) mod 30 sends the symbol. Secure coding fundamentals
Two small Python builds that show security thinking, not just working code
29 unit tests in the two public repos, one cell each: 14 for the calculator, 15 for the card game. Construct OS
Truck and cargo tracking for a friend's transport business
No public evidence to show: a personal build for a friend.
Nine are university coursework or my final-year project; one is a personal build. Each page says which, and links its repo where it’s public.
Check an indicator
Type an IP address, domain, CVE, ATT&CK ID, file or service name. It searches only the 30 indicators published in these case studies, and says so when it has nothing. It’s a search of this site, not the A-TIOC Hub.
All 30 indicators on this site
192.168.50.130practicalmalwareanalysis[.]comIPRIPsvchost.exerundll32.exephpinfo.phpCVE-2014-3566CVE-2016-0800CVE-2003-0253CVE-2007-1001CVE-2008-0599T1566.001T1204T1218.011T1543.003T1112192.168.121.151wp-login.phpJSESSIONIDanonymous.gifT1595T1592T1046T1190T1110.001T1021.001T1552.001T0866T0832T1566.002
Skills, with the evidence
No self-ratings. Each group names the case studies where you can check the work.
Offensive and forensics
- Penetration testing (black-box)
- Nessus, Nmap, Metasploit
- Burp Suite
- Malware analysis (static and dynamic)
- Reverse engineering: IDA, GDB, REMnux
- Wireshark, TShark, PyShark
- testssl.sh, OpenSSL
Shown in
Networking and ICS
- Packet analysis and DPI
- VLAN, NAT, static routing
- Firewall rules and segmentation
- Cisco Packet Tracer
- SCADA and OT security
- CARVER risk assessment
Shown in
Software and AI
- Python: Flask, PyShark, scikit-learn
- C++
- React, Next.js
- Local LLMs: Ollama, Qwen, DeepSeek
- RAG with BGE-M3 embeddings
- ML: XGBoost, Random Forest, MLP
- SQL, SQLite
Shown in
Secure development
- OWASP Top 10 self-testing
- RBAC, CSRF tokens, CSP
- JWT, bcrypt, PBKDF2
- Parameterised SQL
- Unit tests: unittest, CTest
- UK GDPR analysis
Shown in
Cryptography
- AES-256-GCM, HMAC-SHA256
- RSA and cryptanalysis
- Key-exchange protocols
- Symmetric and public-key crypto
- TLS and SSL configuration analysis
Shown in
Experience
Jun to Sep 2025 · Internship
Cyber Security Intern
Receptive Tech Communications · Lahore, Pakistan
- Tuned SIEM correlation rules and alert thresholds to cut false positives during triage.
- Ran recurring vulnerability scans, verified patches and flagged misconfigurations.
- Rewrote escalation matrices and drafted incident-response playbooks.
2025 · Online
Virtual job simulations (Forage)
Telstra · Mastercard · Deloitte Australia
Simulation, not employment
- Telstra (cyber security): responded to a simulated malware incident, then wrote a post-incident analysis with hardening recommendations.
- Mastercard (security awareness): identified the phishing in the exercise and proposed training for high-risk teams.
- Deloitte Australia (cyber): analysed web-activity logs in a simulated breach.
Oct 2023 to Jul 2026
BSc (Hons) Cyber Security
De Montfort University (studied at DMU Dubai)
First Class Honours · awarded 16 July 2026
Held, and SC-900 in progress
Certifications
- Certified in Cybersecurity (CC)ISC2 · May 2026
- Cybersecurity Professional CertificateGoogle · May 2025Detection and response, Python automation, Linux, SQL, threat analysis
- Generative AI Engineering ProfessionalIBM · Aug 2025Generative AI applications & prompt engineering
- Certified Foundations Associate (AI & Cloud)Oracle · Jul 2025AI Foundations + OCI Foundations Associate
- AI Fluency · Claude 101Anthropic
- Security, Compliance, and Identity Fundamentals (SC-900)Microsoft · In progressStudying for the exam; not yet held
About
I work on threat intelligence, network forensics and SOC automation, and I write the software to back it up: an offline SIEM-Lite with a local LLM, an ML phishing detector and C++ security tooling.
Dubai, United Arab Emirates
Looking for SOC Analyst and blue-team roles, mainly in the UAE.
Email me
waleedbukhari2000@gmail.com