Cybersecurity Engineering Student | Blue Team | DFIR | Detection Engineering

Portfolio · LinkedIn · GitHub · Email

                     ======================================================================
                      BLUE TEAM | DFIR | CYBER THREAT INTELLIGENCE | DETECTION ENGINEERING 
                     ======================================================================

• Cybersecurity engineering student at ESIEA, building a profile around vulnerability analysis, defensive tooling and security automation.
• Cyber Threat Intelligence Analyst at ******, working on digital evidence, suspicious infrastructure, IOC enrichment and structured reporting.
• Hands-on experience with Windows, Linux, Active Directory, Microsoft 365, SIEM deployment and incident triage.
• Seeking a 36-month cybersecurity apprenticeship with a 2 weeks company / 2 weeks school schedule in France.

Offline Windows and Active Directory investigation toolkit with a CLI and local web interface.

• EVTX, JSON, CSV, CEF, XML, Syslog and ZIP ingestion
• deterministic detections and correlations
• timeline reconstruction, attack-path analysis and exposure scoring
• HTML, JSON, CSV, ATT&CK Navigator and Mermaid exports

Python EVTX FastAPI MITRE ATT&CK DFIR

Governance CLI for Sigma and detection catalogs, built as a quality-control layer around detection content before merge or release.

• catalog quality scoring across metadata, noise, structure, ATT&CK mapping, maintainability, weakness and documentation
• semantic duplicate detection based on event-surface similarity rather than lexical YAML similarity
• baseline vs candidate comparison to surface regressions before release
• prioritized explanations and remediation guidance for weak rules
• HTML, Markdown, JSON, SARIF and ATT&CK Navigator exports
• CI-ready quality gates for pull requests and detection catalog releases

Python Sigma MITRE ATT&CK Detection Engineering CI/CD

• Detection and investigation: SIEM, EDR, Sysmon, Sigma, MITRE ATT&CK, EVTX, IOC analysis
• Infrastructure: Active Directory, Windows Server, Linux, Microsoft 365, Entra ID, Docker, Ansible
• Network and reconnaissance: TCP/IP, DNS, Wireshark, Nmap, Shodan, Suricata, Zeek
• Security platforms: Splunk, Wazuh, Elastic, OpenCTI

• Active Directory forensics and attack-path reconstruction
• SOC investigation and SIEM workflows
• Detection engineering and rule quality
• Sigma catalog governance and CI quality gates
• CTI, IOC enrichment and incident reporting

• Cisco CyberOps: SOC Operations
• NIST Cybersecurity Framework 2.0
• CyberDefenders