Skip to content

Follow the evidence

A working vocabulary.

From KQL and PowerShell to EDR investigations, threat modelling and SOAR integration. Every skill leads to the work where I used it.

ANY.RUN AWS EC2 AbuseIPDB Acceptance testing Access-control assessment Active Directory Adversary-in-the-Middle Analyst development Assumed-breach assessment Attack-path analysis Attack-surface assessment Authentication analysis Azure DevOps Azure sign-in logs Bash Browser artefacts Claroty Claroty context Client communication Client reporting Cloud configuration review Community leadership Computer Science Concurrency control Control assurance Control coverage review Copilot Studio Corrective-action reporting Craft CMS Cross-source investigation CrowdStrike Cryptography DLL hijacking Data analysis Data migration Defender Attack Disruption Defender Live Response Detection as code design Detection feasibility Detection lifecycle design Detection use-case development Developer onboarding Digital forensics Dynamic analysis EDR coverage Email authentication Email security Endpoint configuration Engagement oversight Engagement scoping Entity mapping Escalation design Evidence handover Executive communication Git IP attribution Inbox-rule analysis Incident investigation Incident lifecycle Incident lifecycle design Incident reporting Incident response Incident timeline reconstruction Incident-response collection Information Security Integration testing Investigation quality assurance Investigation standards KQL Kerberos LOLBins Linux MDR collaboration MDR transition MFA investigation MITRE ATT&CK MSBuild Mailbox audit Management cover Microsoft 365 Microsoft Defender for Endpoint Microsoft Entra ID Microsoft Sentinel MySQL NAT NTLM NTLMv2 NetSupport Network analysis Network security Network segmentation testing Nginx OSINT OT monitoring OWASP Offensive-service delivery Operational handover PHP Packet analysis Payload development Persistence analysis Philosophy Phishing simulation Physical security assessment Power Automate PowerShell Prefetch Process analysis Procmon Production troubleshooting Python QR-code assessment Quick Assist Ransomware research Raspberry Pi Reconnaissance automation Recruitment and onboarding Registry persistence Report review Reporting automation Response ownership Risk prioritisation Runbook development SOAR SOC continuity SOC leadership SOC shift leadership Security testing Service requirements ServiceNow SIR ServiceNow SecOps Social-engineering exercises Source-code review Static analysis Synthetic test data Technical documentation Technical governance Technical leadership Technical reporting Telemetry dependencies Telemetry requirements Threat intelligence Threat modelling MSSP SIEM MSSP SOAR VPN logs Velociraptor VirusTotal Web application testing Windows Windows API analysis Windows Security Events Windows forensics WordPress Workflow automation XSOAR