I build hands-on security labs that go beyond installing tools: every project follows the full SOC cycle — build the environment, simulate the attack, detect it, respond, and document it like a real incident.
- 🛡️ Focus: SOC operations, detection engineering and incident response
- 🤖 Currently exploring: AI-assisted alert triage and the security of AI systems (prompt injection)
- 🎓 Advanced Cybersecurity Technician · English B2
- 💼 Open to junior SOC / Blue Team opportunities in Costa Rica
| Project | What it demonstrates | Status |
|---|---|---|
| Corporate SOC Simulation | Windows Server 2022 + Active Directory domain (Nimbrek S.A.) monitored by Wazuh; AD attack detection mapped to MITRE ATT&CK | 🟡 In progress |
| Home SOC Lab | Full incident lifecycle: exploitation (CVE-2007-2447), C2 detection with Wazuh + Suricata, remediation, incident report and an AI triage pipeline red-teamed against prompt injection | ✅ Complete |
SIEM / Detection: Wazuh · Suricata · custom detection rules · MITRE ATT&CK Windows: Windows Server 2022 · Active Directory · Group Policy · PowerShell Linux & offense (for defense): Kali Linux · Metasploit · Nmap Automation & AI: Python · Claude API · Telegram bots Infrastructure: VirtualBox · isolated lab networking
