SOC analyst · incident response · threat hunting · Baghdad, Iraq
I read an alert by asking how I'd have caused it.
op-h@security
─────────────────────────────────────────────────────────
Focus:.............. SOC / Incident Response / Threat Hunting / DFIR
Experience:......... Summer Intern, MoI Cyber Security Directorate (2026)
Uptime:............. 3y in cybersecurity (since Oct 2023)
OS:................. Kali Linux, Windows
Blue Team:.......... Splunk, Elastic, Snort, MITRE ATT&CK
Red Team:........... Nmap, Burp Suite, Metasploit
Forensics:.......... Wireshark, memory and disk analysis
Languages:.......... Python, SQL, C/C++, Bash, HTML, CSS
Other:.............. Docker
I start at the alert and walk it back until I find the cause.
ALERT → triage in the SIEM: Splunk, Elastic, Snort
TRACE → hunt through packets, memory and disk: Wireshark, eCTHP, eCDFP
CAUSE → rebuild the attacker's path with MITRE ATT&CK and contain it: eCIR
BUILD → turn what I learn into a tool
| Project | Role | Stack |
|---|---|---|
| Nmap Studio — free GUI for nmap with a live scan countdown, 600+ NSE scripts with risk levels, exports to HTML / CSV / JSON / Markdown | Creator | Python, Qt |
| Datacenter Ghost — browser-only DFIR CTF: 19 log sources in an in-browser SQLite console, one insider (play) | Creator | HTML, JavaScript, SQLite (WASM) |
| SOC Training & Phishing Simulation Platform — multi-vector awareness platform (phishing, smishing, vishing, whaling) with campaign telemetry, resilience scoring, exportable audit reports | Lead Architect | Next.js, TypeScript, PostgreSQL, Prisma, Docker |
| wctfsv — Web CTF Solver — modular CLI for authorized web pentesting: SQLi/XSS detection, dir/subdomain enum, header/cookie/source analysis, chained scans, JSON reports | Creator | Python, Kali Linux |
| Cyberpath — generates personalised, shareable cybersecurity learning roadmaps across six tracks, scaled to experience/pace/budget; dependency-free PDF export, WCAG 2.2 AA | Creator | Vanilla JS, CSS, HTML |
| Certificate | Issuer | Date |
|---|---|---|
| Certified Digital Forensics Professional (eCDFP) | INE | Sep 2026 |
| Certified Threat Hunting Professional (eCTHP) | INE | Sep 2026 |
| Certified Incident Responder (eCIR) | INE | Aug 2026 |
| ISO/IEC 27001 Information Security Associate | skillfront | Aug 2026 |
| Security Analyst Level 1 (SAL1) | TryHackMe | Jul 2026 |
| SOC Level 1 Certificate | TryHackMe | Jul 2026 |
| Certified Cybersecurity Educator Professional (CCEP) | Red Team Leaders | Apr 2026 |
| CS50x & CS50 Cybersecurity | Harvard University | Sep 2024 |