SOC Analyst · IT Security Engineer · Cloud Engineer
Newcastle, United Kingdom
SOC Analyst and Cloud-capable IT Security professional with 5+ years running enterprise security, cloud, and network operations across Microsoft Sentinel, Defender XDR, Azure, and Entra ID. Operates a global Tier 2 / Tier 3 SOC single-handed with zero supervision, closing 20+ tickets a day at a 30-minute MTTR while handling daily phishing cases for a worldwide user base. Authors KQL detections, drives Tenable-led vulnerability remediation in line with ISO 27001 and GDPR, and brings a strong cloud engineering foundation with hands-on Terraform, Azure DevOps, Docker, and CI/CD. Operates a production-style blue-team home lab on Proxmox covering SIEM, DFIR, detection-as-code, and purple-team operations — write-ups in the Projects section below. Looking for a Cybersecurity, IT Security, or Cloud Engineer role where proactive detection and automation have direct business impact.
Closes 20+ tickets per day at a 30-minute MTTR across Sentinel, Defender XDR, Zscaler, and BeyondTrust — owning every alert from triage to post-incident review.
Handles daily phishing cases for a globally distributed user base, containing credential and payload-based attacks within the same shift they are reported.
Engineered custom KQL detections and hunt queries in Sentinel that surfaced threats default rules missed — lifting overall detection fidelity.
Keeps the estate audit-ready against ISO 27001 and GDPR by driving Tenable Nessus scans, remediation tracking, and fix validation with asset owners.
Supported 5,000+ BT and EE users across UK sites while meeting SLAs on VPN, Windows 10/11, Intune, and Active Directory.
Bridges security and cloud engineering — trained in Terraform, Docker, Jenkins, and Azure DevOps Pipelines (AppMigro 2024–2025) and applies security-as-code to detection content.
Mott MacDonald · Newcastle, UK (Hybrid)
Mott MacDonald · Newcastle, UK (Hybrid)
BT / EE via Hays Talent Solutions · Gosforth, North Tyneside & Remote
Naynav Engineering Services · Newcastle, UK (Remote)
Biswal Telecoms · Lagos, Nigeria
A production-style blue-team home lab on Proxmox, building toward an end-to-end SOC stack — SIEM, DFIR, detection-as-code, deception, and purple-team operations. Each project ships with a public write-up, repo, and key learnings. Updated as work lands.
Proxmox VE host with pfSense gateway and DNS forwarder, Active Directory forest (lab.local) on Windows Server 2022, six OUs and eleven seeded users including SPN-tagged service accounts for later Kerberoast practice, and three domain-joined Windows 11 endpoints. Snapshots taken at every meaningful checkpoint for clean rollback.
Wazuh 4.x all-in-one (manager + indexer + dashboard) ingesting three telemetry sources — Sysmon with Olaf Hartong's modular config from DC01 and Win11-User01, File Integrity Monitoring on persistence paths and autorun registry keys, and pfSense syslog (firewall, DHCP, system events). Vulnerability detection module running against NVD + MSRC feeds; documented a real-world feed-coverage gap on Win11 24H2 builds.
Atomic Red Team techniques fired against the lab to drive detection engineering: author Sigma rules, convert to Wazuh, version in Git, and measure coverage against MITRE ATT&CK.
Endpoint hunt and triage at scale — VQL hunts for persistence, lateral movement, and credential access; artefact collection and timeline reconstruction across the AD estate.
Self-hosted MISP with curated feeds, IOC enrichment pipeline, and bidirectional integration into the SIEM — surfacing community intel inside Wazuh detections and pushing local findings back out.
FastAPI app that scans my own digital footprint — HIBP, Sherlock, search dorks, data-broker enumerators — pushes findings into MISP as private events and drafts UK GDPR Article 17 erasure requests via the Gmail API.
Case management and analyser/responder framework wired to MISP and Wazuh. Phishing triage playbook that mirrors my day job — observable extraction, multi-source verdict, automated mailbox actions, IOC publishing.
Caldera adversary emulation against the lab AD; BloodHound to surface attack paths; close the loop by hardening the directory and validating that detections fire end-to-end.
Multi-protocol honeypot stack on the DMZ VLAN. Attacker telemetry forwarded into Wazuh and enriched with MISP intel — turns scan-noise into local IOCs that improve real detections.
Detonation chamber for emails and attachments — Cuckoo or any.run-style analysis with verdict feeding straight into TheHive cases and MISP intel records.
Free Azure tenant standing up Defender for Cloud, Sentinel, KQL detections, and Logic App responders — mirroring the production SOC tools I run at work, fully owned end-to-end.
End-to-end breach scenario across the lab — initial access through to exfiltration, exercised against the SIEM, SOAR, and DFIR stack with an audit-ready incident report as the deliverable.
Certified Ethical Hacker · EC-Council
Certified in Cybersecurity
Microsoft Security, Compliance & Identity Fundamentals
AWS Certified Cloud Practitioner
Networking fundamentals
Service management
AppMigro 2024–2025 · Terraform, Docker, Jenkins, Git, CI/CD
In view: CompTIA Security+ · Microsoft MD-102 · Microsoft AZ-900 · ServiceNow Admin
Ladoke Akintola University of Technology, Nigeria · 2011
Open to Cybersecurity, IT Security, or Cloud Engineer roles where proactive detection and automation have direct business impact. Based in Newcastle, available UK-wide and hybrid/remote.