OPEN TO SOC / DFIR INTERNSHIPS · TOP 5% CYBERDEFENDERS
Security Analyst
Entry-level Security Analyst investigating threats through a self-built SOC lab — SIEM alert triage, malware and phishing analysis, mapped to MITRE ATT&CK.
SECTION 02 / ABOUT
Entry-level Security Analyst based in Meerut, UP, currently pursuing a BCA in Cloud & Cybersecurity (2024–2027) at IIMT University. Builds and runs a self-managed SOC lab for hands-on detection and monitoring practice, and develops independent security tools for malware and phishing analysis. Comfortable across SIEM, IDS/IPS, endpoint monitoring, network analysis, and DFIR tooling.
Color shifts by section, mapped to Defense-in-Depth layers — perimeter to data.
SECTION 02A / DEFENSE IN DEPTH
Network layer
SIEM correlation, traffic inspection, and protocol-level threat detection
Click any ring · Tab + Enter works too.
SECTION 03 / EXPERIENCE
Independent
SECTION 03A / SOC LAB ENVIRONMENT
Attack and defense VMs with SIEM, IDS, and endpoint monitoring.
Central Log Management
Central log aggregation and alert triage. Collects Sysmon events from Windows and auditd logs from Linux. Correlates across endpoints to detect lateral movement and persistence.
5
VMs
3
Tools
150+
Alerts
SECTION 04 / SKILLS & TOOLS
SECTION 05 / MITRE ATT&CK
Detection coverage across 14 MITRE ATT&CK tactics, full kill-chain — open on desktop for the interactive matrix.
SECTION 06 / PROJECTS
Tools I've built and investigations I've documented — each mapped to real attacker techniques.
Malware triage tool scanning PE, ELF, Mach-O, APK, Office, PDF, scripts, and archives via a Flask/WebSocket dashboard. 2,778 YARA rules from 40 sources. Connects VirusTotal, Hybrid Analysis, Tria.ge, and FileScan.io with live scan progress. Drop a file — or a whole folder — and the queue triages everything in one pass, streaming verdicts to the browser as each engine reports back. Verdicts arrive with matched rules and engine reports side by side, so one screen answers the first triage question. Every scan leaves a shareable record you can revisit later.
Challenge: Manual triage across many file formats is slow — analysts jump between separate tools for each type.
11-step Flask tool validating SPF, DKIM, DMARC, and ARC to catch spoofed emails. Brand-check system covering ~50 commonly faked brands plus QR-code (quishing) detection. ~40-signal risk-scoring model mapped to MITRE ATT&CK T1566. Paste any raw email or .eml and get a full header breakdown, an impersonation verdict, and plain-English reasoning for every signal — evidence an analyst can act on, not a black-box score. Results are structured for handoff — each failed check links straight to the header evidence behind it.
Challenge: Spoofed and brand-impersonating emails pass casual inspection; authentication results are buried in headers most users never read.
Fast, analyst-first Windows EVTX viewer with built-in IOC extraction, Sigma rule matching, and MITRE ATT&CK mapping. Upload one or many .evtx files, filter by event ID/channel/provider, bookmark events, take notes, and export results. Drag in a full event dump and pivot instantly — jump to matched Sigma hits, correlate extracted IOCs, and build the case notes as you go. One search box covers events, IOCs, and notes, so the pivot from timeline to evidence stays under a minute. Results export cleanly for case notes and reports.
Challenge: Windows EVTX files are cumbersome to parse manually; analysts need a fast viewer with built-in intel enrichment in one interface.
Real phishing, malware, and network attack investigations with detailed reports — IOC extraction and MITRE ATT&CK mapping. Full case log in Field Reports below. Seven published write-ups so far. Each report follows the same SOC cadence — scope, timeline, evidence, IoCs, detection gaps, and recommendations — so every conclusion is reviewable end to end. The library keeps growing as each new lab case gets written up in the same format. Every report is written to be reviewed end to end, with the full artifact trail attached.
Challenge: Lab skills are invisible without documented, reviewable investigations written the way a real SOC writes them.
Real-time threat intelligence aggregator pulling from multiple open-source feeds — URLhaus, ThreatFox, AlienVault OTX, and AbuseIPDB. Correlates indicators, surfaces attacker infrastructure, and maps IoCs to MITRE ATT&CK techniques. Indicators are normalized, deduplicated, and confidence-scored, so campaign infrastructure stands out from feed noise instead of drowning in it. Related indicators are grouped into campaigns, turning the raw feed into attacker storylines. The dashboard surfaces the infrastructure behind each campaign.
Challenge: Threat intel feeds generate massive noise. Analysts need correlation, dedup, and ATT&CK mapping — not a raw feed reader.
SECTION 07 / FIELD REPORTS
Real investigations and CTF walkthroughs — from phishing campaigns to RAT analysis, documented step by step.
Social engineering · Advance-fee job scam
Read report →Cloud compromise
Read report →Artifact triage
Read report →LLMNR/NBT-NS poisoning · NTLMv2 credential capture
Read report →SECTION 07A / LIVE ACTIVITY
Fetched client-side from the GitHub API and Medium RSS at page load — not hand-written cards. If a network fetch fails, the block below says so instead of faking it.
FETCHING github.com/EclipseManic …
FETCHING eclipsemanic.medium.com …
SECTION 08 / CREDENTIALS
Microsoft Azure Cloud Administration
EICT, IIT Kanpur · Verify ↗
Linux Administration with Scripting
EICT, IIT Kanpur · Verify ↗
AWS Cloud Fundamentals
EICT, IIT Kanpur · Verify ↗
Google Cybersecurity Professional Certificate
Coursera · Verify ↗
IBM Cybersecurity Analyst
Coursera · Verify ↗
Bachelor of Computer Application — Cloud & Cybersecurity
IIMT University, Meerut
Focus areas
Open to SOC / DFIR internships
Security Analyst
I investigate what others miss — every alert triaged, every log correlated, every threat mapped to how it actually happened.
01 — Background
Entry-level Security Analyst based in Meerut, UP, pursuing a BCA in Cloud & Cybersecurity (2024–2027) at IIMT University. Comfortable across SIEM, IDS/IPS, endpoint monitoring, network analysis and DFIR tooling.
Feb 2026 — Present
Independent
02 — Inside the lab
A self-managed SOC lab — Wazuh SIEM and Suricata IDS across attack and defense VMs — built to generate, catch and investigate real alerts end to end. Five layers deep, perimeter to data.
03 — Selected work
04 — Credentials
05 — Field reports
06 — Contact
Open to SOC / DFIR internships and junior analyst roles. If you have alerts, I have eyes.
manichand.gupta.contact@gmail.comMeerut, UP · © 2026 Manichand Gupta