Cybersecurity Engineering Student | Blue Team | DFIR | Detection Engineering
Portfolio · LinkedIn · GitHub · Email
======================================================================
BLUE TEAM | DFIR | CYBER THREAT INTELLIGENCE | DETECTION ENGINEERING
======================================================================
- Cybersecurity engineering student at ESIEA, building a profile around vulnerability analysis, defensive tooling and security automation.
- Cyber Threat Intelligence Analyst at ******, working on digital evidence, suspicious infrastructure, IOC enrichment and structured reporting.
- Hands-on experience with Windows, Linux, Active Directory, Microsoft 365, SIEM deployment and incident triage.
- Seeking a 36-month cybersecurity apprenticeship with a 2 weeks company / 2 weeks school schedule in France.
Offline Windows and Active Directory investigation toolkit with a CLI and local web interface.
- EVTX, JSON, CSV, CEF, XML, Syslog and ZIP ingestion
- deterministic detections and correlations
- timeline reconstruction, attack-path analysis and exposure scoring
- HTML, JSON, CSV, ATT&CK Navigator and Mermaid exports
Python EVTX FastAPI MITRE ATT&CK DFIR
Governance CLI for Sigma and detection catalogs, built as a quality-control layer around detection content before merge or release.
- catalog quality scoring across metadata, noise, structure, ATT&CK mapping, maintainability, weakness and documentation
- semantic duplicate detection based on event-surface similarity rather than lexical YAML similarity
- baseline vs candidate comparison to surface regressions before release
- prioritized explanations and remediation guidance for weak rules
- HTML, Markdown, JSON, SARIF and ATT&CK Navigator exports
- CI-ready quality gates for pull requests and detection catalog releases
Python Sigma MITRE ATT&CK Detection Engineering CI/CD
- Detection and investigation: SIEM, EDR, Sysmon, Sigma, MITRE ATT&CK, EVTX, IOC analysis
- Infrastructure: Active Directory, Windows Server, Linux, Microsoft 365, Entra ID, Docker, Ansible
- Network and reconnaissance: TCP/IP, DNS, Wireshark, Nmap, Shodan, Suricata, Zeek
- Security platforms: Splunk, Wazuh, Elastic, OpenCTI
- Active Directory forensics and attack-path reconstruction
- SOC investigation and SIEM workflows
- Detection engineering and rule quality
- Sigma catalog governance and CI quality gates
- CTI, IOC enrichment and incident reporting
- Cisco CyberOps: SOC Operations
- NIST Cybersecurity Framework 2.0
- CyberDefenders