Cyber Security Analyst · detection engineering, incident response, security automation
B.Sc. Computer Science, Holon Institute of Technology (2026)
I work as a Tier 2 SOC analyst. I write and tune Splunk and CrowdStrike detections mapped to MITRE ATT&CK, investigate escalated incidents, and build tools the team uses every day. Most of that is Python, shipped in containers through CI/CD.
The code for these is private. They run in production at work.
A 24/7 pipeline that flags actively exploited CVEs from open-source feeds, so the SOC learns about live exploitation the same day. Gemini on Vertex AI enriches each item and extracts IOCs. ChromaDB embeddings match reports of the same threat across sources. Outbound fetches are checked against SSRF: a DNS lookup before every request and redirect, with private, loopback, and cloud-metadata ranges blocked. It deploys through GitHub Actions on a self-hosted runner with CodeQL SAST, runs as a non-root container with secrets in GCP Secret Manager, and a cron watchdog restarts stopped containers and alerts on disk, CPU, and RAM.
Python · Gemini / Vertex AI · ChromaDB · Docker · GitHub Actions · CodeQL · GCP Secret Manager
An event-driven pipeline over Kafka (Redpanda) that embeds incident-response playbooks into ChromaDB, clusters them into MITRE-aligned threat categories, and has an LLM write one consolidated Master Playbook per cluster. It cut 500+ overlapping playbooks to 12, now in use across the SOC.
Python · Kafka (Redpanda) · ChromaDB · LLM APIs
Agent-based security monitoring for macOS. The agent collects process, file, network, and authentication events and sends them to a FastAPI backend, where YAML detection rules raise alerts such as brute-force logins and outbound connections to known C2 ports. Alerts go through a Redis queue to a live React/TypeScript dashboard over WebSocket. Runs in Docker Compose, with pytest and GitHub Actions CI.
Python · FastAPI · Redis · React · TypeScript · Docker Compose · GitHub Actions
