Name: Abdul Rehman
Role: SOC Analyst | Cybersecurity Analyst | Blue Team Portfolio Builder
Location: Bengaluru, India 🇮🇳
Primary Focus:
  - SOC Operations
  - SIEM Monitoring & Alert Triage
  - Linux Security & Hardening
  - AWS Security Monitoring
  - Incident Response Workflows
  - AI Automation for Security Operations
Current Growth Tracks:
  - n8n Automation
  - Agentic AI Workflows
  - Prompt Engineering
  - Context Design
  - RAG / Vector-Based Workflows
Approach: Build → Detect → Investigate → Automate → Document → Improve
Philosophy: Automate Everything
Goal: Become a cybersecurity expert who enhances security operations with AI automation

I’m a hands-on cybersecurity practitioner focused on SOC operations, SIEM monitoring, Linux security, AWS visibility, incident response workflows, and open-source security tooling.

My portfolio is built around real lab execution and deep documentation — not just learning tools, but deploying, validating, investigating, documenting, and improving complete environments.

Over time, I’ve built and documented work across:

• SOC & SIEM operations
• Wazuh-based monitoring and detection
• TheHive / MISP / Cortex workflows
• Linux security hardening and administration
• AWS CloudTrail monitoring and cloud activity visibility
• Java-based cloud integration labs and backend workflow development
• Incident response simulations and case documentation
• Vulnerability validation and security review
• Python / Bash / Ansible automation
• AI automation, n8n workflows, agentic experiments, and prompt engineering

I also completed a full-year student internship alongside my cybersecurity studies and have been consistently building a large, structured GitHub portfolio through hands-on labs, specialist repositories, and capstone-style projects.

This matrix reflects my portfolio-wide hands-on implementation across SOC operations, SIEM, Linux security, AWS monitoring, incident response, automation, AI automation, and analytics.

Exposure bars reflect practical breadth across repositories, capstones, self-built labs, workflow experiments, and documented hands-on projects.

• ██████████ = High practical exposure across multiple repositories, labs, capstones, and repeat implementations
• █████████░ = Strong applied experience with clear portfolio depth and documented workflows
• ████████░░ = Solid working implementation with growing depth and continued expansion

This matrix reflects overall portfolio capability, not one isolated repository — covering:

SOC → Detection → Investigation → Enrichment → Hardening → Monitoring → Automation → Documentation → Continuous Improvement

A flagship open-source security operations environment built around detection, alerting, triage, investigation, case handling, response support, and feedback-driven improvement.

Highlights:

• Wazuh SIEM deployment and monitoring
• TheHive case management workflows
• MISP threat intelligence enrichment
• Cortex analyzer integration
• MITRE ATT&CK-aligned investigation thinking
• AWS-hosted security lab architecture
• Alert-to-case operational flow
• Structured documentation, workflows, and architecture diagrams

A structured defensive-security portfolio focused on monitoring, visibility, alert understanding, incident logic, and blue-team workflows.

Highlights:

• Windows and Linux detection scenarios
• Sysmon-aligned visibility
• SIEM alert validation and investigation
• Threat simulation in controlled lab settings
• Detection workflows with practical documentation
• Security operations reasoning beyond simple tool installation

A large body of work centered on Linux administration, system hardening, service control, access security, and enterprise-style operational discipline.

Highlights:

• SSH hardening
• user, group, and privilege management
• firewall and access restriction
• service monitoring and troubleshooting
• auditing, logging, and baseline defense
• backup, recovery, and maintenance workflows

A portfolio direction showing growth in RHEL administration, repeatable operations, automation, container workflows, and security-conscious system management.

Highlights:

• RHEL-focused administration
• SELinux / AppArmor exposure
• Ansible usage and automation workflows
• Podman / container exposure
• system consistency and operational repeatability
• security-first enterprise administration foundations

Hands-on work around cloud logging, IAM-related activity awareness, event visibility, and practical cloud monitoring use cases.

Highlights:

• CloudTrail monitoring
• IAM event awareness
• login and activity visibility
• cloud-side action review
• security observation in AWS lab environments
• cloud monitoring documentation and validation

Hands-on exposure to vulnerability review, hardening validation, security checks, and remediation-oriented analysis.

Highlights:

• vulnerability assessment workflows
• configuration review and hardening validation
• security posture observation
• scan result interpretation
• practical improvement mindset
• documentation-backed validation

An active and growing track focused on automating repetitive workflows, building AI-assisted task chains, testing agentic ideas, and learning how automation can improve real operations.

Highlights:

• Autonomous Browser Agent
• Email Responder Multi-AI Agent
• AI Voice Email Sender Agent
• LinkedIn Content Creator Agent
• Inventory Management RAG workflow
• prompt engineering and context design practice
• workflow testing in safe learning environments
• growing focus on operational AI automation

A parallel skill track strengthening scripting, analytical reasoning, automation potential, and data-driven thinking for technical/security-adjacent use cases.

Highlights:

• Python foundations
• Pandas / NumPy workflows
• visualization and exploratory analysis
• statistics and probability
• machine learning foundations
• NLP exposure
• time-series exposure
• deep learning foundations

I want to become a cybersecurity expert who strengthens and scales security operations through AI automation.

My long-term goal is to understand how security teams, SOC workflows, investigations, monitoring pipelines, reporting, triage, and repetitive operational tasks can be improved through intelligent automation.

I believe this direction matters because:

• security challenges are growing rapidly
• AI is reshaping how work gets done
• many repetitive tasks in security can be automated
• better automation can improve analyst efficiency
• AI-assisted operations can become more practical and cost-effective even for small organizations

That is why I’m actively growing in:

• AI automation
• agentic workflows
• prompt engineering
• workflow orchestration
• security + automation integration
• the idea of automating everything that should be automated

• alert triage and investigation thinking
• Wazuh monitoring, visibility checks, and detection workflows
• event interpretation, false-positive review, and escalation context
• case-oriented analysis and reporting mindset

• IOC review and enrichment
• TheHive / MISP / Cortex-oriented workflows
• MITRE ATT&CK mapping and analyst context building
• structured investigation and response documentation

• hardening Linux systems and services
• SSH security, privilege control, permissions, and access management
• logging, auditing, and service monitoring
• troubleshooting and security-minded system administration

• CloudTrail visibility and activity review
• IAM-related event awareness
• monitoring cloud actions in lab environments
• cloud security observation and documentation

• Java-based cloud integration lab work
• backend workflow understanding and service interaction
• practical implementation exposure through integration-focused labs
• growing development-side understanding alongside security operations

• n8n-based workflow building
• multi-step automation experiments
• prompt engineering and context design practice
• AI-assisted task automation in learning environments
• exploring how automation can support modern security operations

• Bash / Python scripting for operational support
• Ansible and repeatable admin tasks
• structured documentation-backed execution
• reducing repetitive work through automation-first thinking

• EduQual RQF Level 3 Diploma in Cloud Cyber Security — Al-Nafi International College (in progress)
• Cyber Security Internship — Al-Nafi International College (in progress)
• Cloud Cyber Security Course Completion — Al-Nafi International College
• Certified in Cybersecurity (CC) — ISC2
• SOC Analyst & Cybersecurity Job Simulations — FORAGE (TATA, Deloitte, AIG, Datacom, Telstra, Datacom, Commonwealth Bank)
• ISO/IEC 27001:2022 Lead Auditor — Mastermind
• Certified Phishing Prevention Specialist (CPPS) — Hack & Fix
• Certified Threat Intelligence & Governance Analyst (CTIGA) — Red Team Leaders
• Certified Red Team Operations Management (CRTOM) — Red Team Leaders
• AI Masterclass & Workshops — Dhruv Rathee Academy, GrowthSchool, be10x
• AWS DevOps and Agentic AI Masterclass — Train with Shubham
• Data Analytics Essentials — Cisco Networking Academy
• Certified Fundamentals in Cybersecurity — Fortinet
• Cybersecurity Fundamentals & SOC in Practice — IBM SkillsBuild
• Enterprise Security in Practice — IBM SkillsBuild
• Threat Intelligence & Hunting Fundamentals — IBM SkillsBuild
• Artificial Intelligence Fundamentals — IBM SkillsBuild

This section highlights the end-to-end architecture, analyst workflow, and threat-intelligence feedback loop behind my SOC / SOAR capstone work using Wazuh, TheHive, Cortex, MISP, AWS, and Sysmon.

flowchart LR
  %% =========================================================
  %% SOC + SOAR + TI — End-to-End Workflow (Swimlanes, Boxed)
  %% with stronger lane separators (GitHub Mermaid friendly)
  %% =========================================================

  A_ENR[" "]:::anchor
  A_IR[" "]:::anchor
  A_TI[" "]:::anchor
  A_FB1[" "]:::anchor
  A_FB2[" "]:::anchor

  F1[" "]:::frame
  F2[" "]:::frame
  F3[" "]:::frame
  F4[" "]:::frame
  F5[" "]:::frame
  F6[" "]:::frame

  F1 -.-> F2
  F2 -.-> F3
  F3 -.-> F4
  F4 -.-> F5
  F5 -.-> F6

  subgraph L1[" "]
    direction TB
    H1["🪟 Endpoint"]:::laneHeader
    SIM["🧨 Controlled Attack Simulation<br/>PowerShell • DNS • File Drop • Persistence • Network"]:::stage
    ENDPOINT["Sysmon + Wazuh Agent<br/>Telemetry collection"]:::stage
    H1 --> SIM --> ENDPOINT --> F1
  end

  subgraph L2[" "]
    direction TB
    H2["🛡️ SIEM / XDR (Wazuh)"]:::laneHeader
    WAZ["Wazuh Manager<br/>Rules • Correlation • Alerts"]:::stage
    IDX["Wazuh Indexer<br/>OpenSearch"]:::stage
    WDASH["Wazuh Dashboard<br/>Hunting • Evidence • Discover"]:::stage
    H2 --> WAZ --> IDX --> WDASH --> F2
  end

  subgraph L3[" "]
    direction TB
    H3["👨‍💻 SOC Analyst"]:::laneHeader
    ANALYST["Triage + Investigation<br/>Review ➜ Correlate ➜ Extract IOCs"]:::human
    GATE["Decision Gate<br/>True Positive confirmed?"]:::decision
    H3 --> ANALYST --> GATE --> F3
  end

  subgraph L4[" "]
    direction TB
    H4["🗂️ Case Mgmt + SOAR (TheHive + Cortex)"]:::laneHeader
    THEHIVE["TheHive Case<br/>Alert ➜ Case ➜ Tasks ➜ Timeline"]:::stage
    OBS["Observables / IOCs<br/>Hash • Domain • IP • URL • File • Registry"]:::stage
    CORTEX["Cortex Automation<br/>Analyzers / Responders"]:::stage
    ENR["Enrichment Results<br/>VT • OTX • MISP lookups etc."]:::stage
    MITRE["MITRE ATT&CK Mapping<br/>Evidence ➜ Techniques ➜ TTPs"]:::stage

    H4 --> THEHIVE --> OBS --> A_ENR
    A_ENR --> CORTEX --> ENR --> A_ENR
    ENR --> THEHIVE
    THEHIVE --> MITRE --> A_IR --> F4
  end

  subgraph L5[" "]
    direction TB
    H5["🛠️ Incident Response"]:::laneHeader
    IRFLOW["IR Lifecycle<br/>Identify ➜ Analyze ➜ Contain ➜ Eradicate ➜ Recover ➜ Review"]:::ir
    ACTIONS["Endpoint Actions<br/>Triage • Kill proc • Block C2 • Remove persistence • Export EVTX"]:::action
    CLOSE["Case Closure<br/>Final report • Timeline • Metrics • Lessons learned"]:::outcome

    H5 --> IRFLOW --> ACTIONS --> IRFLOW
    IRFLOW --> CLOSE --> A_TI --> F5
  end

  subgraph L6[" "]
    direction TB
    H6["🧠 Threat Intelligence (MISP)"]:::laneHeader
    MISP["MISP Event<br/>Validated IOCs + Tags + Context"]:::ti
    SHARE["Share / Reuse<br/>Correlation • Community • Future detections"]:::ti
    H6 --> MISP --> SHARE --> F6
  end

  ENDPOINT -->|📤 Sysmon telemetry| WAZ
  WDASH --> ANALYST
  GATE -->|📌 Escalate IOCs + evidence| THEHIVE
  A_IR --> IRFLOW
  A_TI -->|✅ Export validated IOCs| MISP

  SHARE -.-> A_FB1 -.->|♻️ Improve detections| WAZ
  SHARE -.-> A_FB2 -.->|🔍 Faster correlation| WDASH

  OUT["🏁 Outcome<br/>End-to-end SOC workflow + SOAR automation + TI feedback loop"]:::outcome
  CLOSE --> OUT

  classDef laneHeader fill:#0b1220,stroke:#94a3b8,stroke-width:3px,stroke-dasharray: 6 4,color:#e5e7eb;
  classDef stage fill:#111827,stroke:#475569,stroke-width:1px,color:#e5e7eb;
  classDef human fill:#0f172a,stroke:#22c55e,stroke-width:1px,color:#e5e7eb;
  classDef decision fill:#0f172a,stroke:#f59e0b,stroke-width:2px,color:#e5e7eb;
  classDef ir fill:#0f172a,stroke:#60a5fa,stroke-width:1px,color:#e5e7eb;
  classDef action fill:#0f172a,stroke:#ef4444,stroke-width:1px,color:#e5e7eb;
  classDef ti fill:#0f172a,stroke:#a78bfa,stroke-width:1px,color:#e5e7eb;
  classDef outcome fill:#0f172a,stroke:#14b8a6,stroke-width:2px,color:#e5e7eb;

  classDef anchor fill:transparent,stroke:transparent,color:transparent;
  classDef frame fill:transparent,stroke:transparent,color:transparent;

  class A_ENR,A_IR,A_TI,A_FB1,A_FB2 anchor;
  class F1,F2,F3,F4,F5,F6 frame;

  linkStyle 0 stroke:#94a3b8,stroke-width:4px,stroke-dasharray:10 6,opacity:0.95;
  linkStyle 1 stroke:#94a3b8,stroke-width:4px,stroke-dasharray:10 6,opacity:0.95;
  linkStyle 2 stroke:#94a3b8,stroke-width:4px,stroke-dasharray:10 6,opacity:0.95;
  linkStyle 3 stroke:#94a3b8,stroke-width:4px,stroke-dasharray:10 6,opacity:0.95;
  linkStyle 4 stroke:#94a3b8,stroke-width:4px,stroke-dasharray:10 6,opacity:0.95;

🤝✨ Let’s Connect, Collaborate & Build Secure Systems ✨🤝

💼 Professional Services

🔍 SOC Monitoring & Alert Triage Support

Hands-on support for alert review, triage workflows, false-positive analysis, event context building, escalation notes, and analyst-style documentation using open-source security monitoring workflows.

📊 Wazuh SIEM Setup, Visibility & Lab Support

Support for Wazuh installation, agent onboarding, feature exploration, log visibility checks, FIM monitoring, vulnerability detection exposure, dashboard validation, and learning / small-environment deployments.

☁️ AWS Security Monitoring & Cloud Visibility

Support around AWS CloudTrail visibility, IAM-related event awareness, activity monitoring, security observation in cloud labs, and cloud action review for learning and portfolio environments.

🐧 Linux Security Hardening & Administration

Support for Linux server hardening, SSH security, firewall setup, service checks, user and permission management, auditing visibility, troubleshooting, and security-minded administration.

🌐 Web Security, Server Visibility & Log Review

Support for basic web security learning-lab validation, Nginx / web log review, web-facing visibility checks, and security observation for web/server environments.

🌍 Network Visibility & Traffic Analysis Support

Support for basic packet/log visibility, traffic review, service exposure checks, Nmap/Wireshark-oriented lab workflows, and network observation in controlled environments.

🧠 Threat Intelligence & IOC Enrichment Support

Support for IOC review, enrichment workflows, hash/IP/domain context gathering, ATT&CK alignment, investigation support notes, and intelligence-assisted triage thinking.

📝 Incident Response Documentation & Case Workflow Support

Support for investigation writeups, case notes, timeline building, response documentation, lessons learned, containment tracking, and structured SOC-style reporting.

🧪 Vulnerability Review & Security Validation Support

Support for reviewing vulnerability findings, prioritizing visible issues, improving hardening baselines, validating security posture in labs, and documenting remediation-oriented observations.

🤖 AI Automation & n8n Workflow Prototyping

Support for n8n-based automation prototyping, workflow chaining, prompt/context design, AI-assisted task flows, and learning-environment automation for repetitive operational work.

⚙️ Bash / Python / Admin Automation Support

Support for helper scripts, log parsing tasks, repetitive admin automation, workflow simplification, and lightweight technical automation for labs and small environments.

🧱 Security Portfolio / Lab Building Guidance

Support for building portfolio labs, documenting projects clearly, structuring repository READMEs, and presenting technical work professionally for GitHub and career growth.

📧 Reach Out

🌟 If you find my work interesting, please consider:

---

“In cybersecurity, continuous learning is not optional — it is survival.”
— Bruce Schneier

“A man who builds from scratch never fears loss, because what made him cannot be taken away: knowledge, experience, and resilience.”
— Mastering Manhood

Made with 💙 by Abdul Rehman

_{Last Updated: March 2026}