// 03 — technical skills
Technical Skills & Expertise
SIEM & Monitoring
Wazuh (manager, indexer, dashboard), Splunk, log collection, log correlation, alert triage, custom detection rules and decoders, dashboards
Incident Response & Triage
Security event investigation, enterprise incident response workflow, SOAR with Tines, EDR with LimaCharlie, enterprise incident triage (Deloitte Cyber simulation), containment, runbooks, playbooks
Vulnerability Assessment
Nmap scanning, network reconnaissance, vulnerability identification, security exposure reporting
Network & Traffic Analysis
Wireshark, TCP/IP, DNS, HTTP, UFW firewall, suspicious traffic detection
Operating Systems
Linux (Ubuntu, Kali), Windows 10, Windows 11, Windows Server
Scripting & Administration
Bash, cron, user and group management
Frameworks & Methodologies
MITRE ATT&CK, Cyber Kill Chain, NIST, SANS incident response lifecycle
Cloud & Tools
AWS EC2, Docker, Git, GitHub, VMware, VS Code
Reporting & Documentation
Incident documentation, security procedure documentation, management reports
Windows Event Logs & Analysis
Event Viewer, Sysmon, audit log analysis & threat hunting
CIA Triad
Confidentiality, Integrity, Availability
Splunk (Foundational)
Search/SPL, dashboards, log analysis, decoders & custom rules
Threat-Informed Defense & ATT&CK
MITRE ATT&CK v19 operationalization, CTEM loop integration, ATT&CK Navigator heatmaps, detection gap analysis, adversary emulation mapping (AttackIQ certified, 13 CPEs)
Online Fraud & Account Takeover Defense
Credential stuffing prevention, account takeover (ATO) triage, payment gateway anomaly detection, social engineering mitigation, identity theft prevention (COFPS certified)