Forage • Virtual Experience
Mastercard — Cybersecurity
Security-awareness simulation covering phishing simulation design, campaign analysis and targeted security-awareness training.
Phishing AnalysisSecurity AwarenessData AnalysisSecurity Training
CompTIA Security+ Certified (SY0-701) cybersecurity professional with 12+ years of enterprise IT experience across infrastructure, systems administration, Windows/Linux, Active Directory, networking, access control and endpoint security. I apply that operational foundation to security operations, detection engineering, incident response and DFIR through evidence-backed, authorized technical work.
Five evidence-driven defensive case studies covering malware triage, phishing/BEC, modern identity security, ransomware response and AI-assisted SOC operations. Published evidence uses synthetic, safe training artifacts.
Static triage, IOC extraction, YARA, ATT&CK mapping and SOC investigation reporting.
Email headers, SPF/DKIM/DMARC, IOC analysis, identity impact and incident response.
Identity anomaly detection, OAuth consent, privilege changes and Sentinel/KQL-style analytics.
Endpoint telemetry, Wazuh/Sysmon-style detection, containment, evidence preservation and recovery.
Prompt-injection risks, sensitive-data controls, MITRE ATLAS and human-in-the-loop SOC triage.
A local Ollama lab covering eight synthetic prompt-injection scenarios, baseline and defended configurations, privacy-conscious event logging, application-log detection, threat modelling and AI governance artefacts.
1 November 2026 live test: five complete runs (80 cases) using the local llama3.2 default 3B tag. The A2 baseline synthetic-canary detection occurred in 5/5 runs; defended A2 had no exact-canary detection, with the input filter intercepting it in 5/5.
Evidence limits: one local model, synthetic scenarios, exact-canary matching, and a 64-token output cap. A1 and A4 were also intercepted, although the baseline model refused those requests itself. This is a learning lab, not a production assurance assessment.
Focused entry points for recruiters and technical reviewers. Each hub links directly to source evidence in the repository and preserves the portfolio's evidence-scope standard.
Wazuh, Windows telemetry, alert triage and investigation workflows.
Open evidence hub →Detection logic, attack simulation, validation and MITRE ATT&CK mapping.
Open evidence hub →Forensics, evidence handling, timelines, IOC extraction and response.
Open evidence hub →Nmap, Wireshark, PCAP analysis and network assessment evidence.
Open evidence hub →3 real MITRE ATT&CK techniques (Execution T1059, Persistence T1053/T1547, Credential Access T1003), each written to run against 2 real, self-owned targets: the home-lab Linux host and the Azure Windows Server DC documented elsewhere in this portfolio. All 6 technique/platform combinations have preserved live-alert evidence from authorized tests against self-owned Linux and Windows lab targets. The evidence is lab validation, not client or production infrastructure.
Terraform-provisioned Windows Server 2022 VM in Azure with a default-deny NSG, no committed secrets, and daily auto-shutdown for cost control. Deployed, promoted to an AD Domain Controller (lab.local), hardened, and validated end-to-end: 409 real Security events exported and analyzed for 392 findings, plus a live Wazuh Agent connection generating real MITRE-mapped alerts.
Installed Sysmon (SwiftOnSecurity config) on a live, deployed Azure Domain Controller and captured real process-create (Event ID 1) and network-connect (Event ID 3) telemetry, validated against the same detection logic used on synthetic data.
<ProcessAccess onmatch="include">
<TargetImage condition="is">C:\Windows\System32\lsass.exe</TargetImage>
</ProcessAccess>
Executed deep forensic triage on compromised Linux system logs. Verified SHA-256 evidence hashes, mapped actor techniques to MITRE ATT&CK, and produced post-incident timelines.
# sha256sum DFIR/Linux-Forensics/Evidence/auth.log
f5d18ad19f1341cef5b2c3dd6c55504df5936e2adcc73f8a6fefbcdfca3caf87
[+] Synthetic lab evidence: repeated failed SSH attempts from 10.10.20.45; successful analyst login from 10.10.20.10; subsequent sudo activity
CIS Docker Benchmark / MITRE ATT&CK for Containers-style Python audit engine (root user, unpinned tags, hardcoded secrets, privileged mode, docker.sock mounts, host network mode), validated first against synthetic fixtures, then run for real against a home-lab Docker host via a docker inspect-based collector that redacts every env value before it touches disk.
Full TCP port range scan (-sV -sC -p-) against the analyst's own home-lab host, with raw output preserved in all three Nmap formats. An unrecognized service fingerprint on port 9443 was independently verified with curl/ss rather than assumed, revealing Portainer exposed on every network interface instead of scoped like the stack's other services.
Real tcpdump capture (52 packets) of the analyst's own Juice Shop container, including a genuine test of its known SQL-injection-vulnerable search endpoint. Analyzed with this portfolio's existing pcap_soc_analyzer.py, previously validated only against synthetic data - it correctly flagged the real SQLi request (HIGH) while correctly declining to flag a weaker scanner-UA signal alone.
CIS-benchmark-style Python audit engine (SSH config, sudoers NOPASSWD scope, SUID binaries, world-writable files, legacy services, firewall state), validated first against synthetic fixtures, then run for real against a live personal Linux host via a purpose-built collector script.
Real bandit static analysis scan of this portfolio's own 1,278-line Python codebase - not a fictional target. Found and fixed one genuine High-severity issue (unnecessary shell=True command execution). Remaining findings triaged honestly: one confirmed scanner false positive, one documented defense-in-depth recommendation, and low-risk findings reviewed and accepted rather than blindly cleared.
Captured packet traffic using tshark to analyze automated web scans, SQL injection payloads, and command execution attempts. Engineered custom Python scripts for automated triage.
$ python3 pcap_triage.py --file capture.pcap
[+] Extracting HTTP POST payloads...
[!] ALERT: SQLi Payload Detected: ' OR 1=1 --
[!] Source IP: 192.168.1.105 -> Targeted Port: 8080
Deployed Wazuh agents across lab nodes. Authored custom XML detection rules to flag privilege escalation and established File Integrity Monitoring (FIM) for system directories.
<rule id="100002" level="10">
<if_sid>5715</if_sid>
<match>sudo: privilege escalation</match>
<description>Possible privilege escalation alert</description>
</rule>
Completed a six-lab Splunk SOC track covering SSH authentication hunting, Windows/Sysmon process investigation, web-attack investigation, SPL detection engineering, SOC monitoring/dashboarding, and end-to-end incident investigation using controlled synthetic telemetry.
Automated parsing of Windows Security XML event logs (4624, 4625, 4728) using Python to highlight lateral movement, brute force attempts, and unauthorized group escalation.
$ python3 ad_triage.py --event 4728
[!] PRIVILEGE ESCALATION DETECTED
User 'jdoe' added target 'Domain Admins'
Caller User: 'bad_actor_admin'
Real Terraform for a GCP organization landing zone: org-level policy guardrails (no external IPs, no SA key files, domain-restricted IAM), an environment folder structure, a Shared VPC host project with deny-all-ingress firewall rules and Cloud NAT, and a centralized org-wide logging sink. Formatting-checked with terraform fmt; full validate/apply pending a real org (this build environment can't reach the Terraform registry).
Practical cybersecurity simulations completed through Forage. These are virtual work experiences, not employment, and are presented as evidence of applied learning and professional skills.
Security-awareness simulation covering phishing simulation design, campaign analysis and targeted security-awareness training.
Cyberattack investigation and cybersecurity risk assessment covering ransomware response, OSINT, risk prioritization and security recommendations.
Web activity-log investigation focused on suspicious automated API activity, authentication/session behaviour, networking and web security.
Threat analysis simulation covering CISA advisory research, vulnerability identification, remediation communication and a controlled ransomware-recovery exercise.
These are controlled Forage virtual job simulations / virtual experience programs. They are not employment with the participating companies or real-world client engagements.
Loading synchronized GitHub projects…
Core Security Standards
Verify Certification → View Security+ CE Badge →Undergraduate Degree
View the original badge page for credential details.
View & Verify Badge →Combined Google Cybersecurity Certificate and CompTIA Security+ exam achievement.
View & Verify Badge →AI concepts, ethics, applications and introductory IBM Watson Studio awareness.
Verify IBM AI Fundamentals Badge ↗Network monitoring and protection, security alerts, vulnerability assessment and incident response foundations.
View & Verify Badge →Targeting SOC Analyst, Security Operations Analyst, Cybersecurity Analyst, Detection Engineering, Threat Hunting, and Security Engineering opportunities.
Four previously pending evidence tracks now have retained controlled/offline validation artifacts. These exercises use synthetic or offline data and do not represent production incidents or live customer environments.
This portfolio uses one evidence standard across the website and the underlying GitHub case studies. Project claims are tied to retained evidence and are explicitly classified so laboratory work is never presented as production incident experience.
Each evidence-bearing case study follows the permanent 20-section framework covering scenario, scope, methodology, commands/scripts, evidence, observations, analysis, findings, risk, recommendations, detection opportunities, ATT&CK mapping where justified, lessons learned, skills, SOC relevance, limitations, and references.