SOC Analyst / Cybersecurity Analyst

Real portfolio pieces built during the course, not a certificate for its own sake. Each one is work you can show.

• Alert triage logA row per alert across the simulation week: what fired, which sources you checked and over what window, what you found in plain words, the classification, and the action taken or requested.
• Phishing analysis writeupOne page on a reported message: headers and sending infrastructure, why it was malicious and which evidence did not help, who else received and interacted with it, and what you did about the account behind it.
• Incident reportThe full write up of the intrusion on day four: summary for a manager, scope, a sourced timeline, observation kept separate from inference, containment with times and authorisation, impact, and owned actions.
• Escalation noteHalf a screen written under pressure: what you believe is happening and how confident you are, scope, evidence, what you already contained, what you have ruled out, and the decision you need.
• Detection tuning recommendationA one page argument with numbers: firing volume and classification split, the property behind the noise, a narrowly scoped change, what the rule still catches, the coverage lost and how it is covered instead, and a review date.
• Benign activity determinationThe closing writeup for a cluster of alerts that turned out to be authorised work: the account and the source host established from the underlying events, every event tied to one logon session, the change record read for what it omits, the engineer who confirmed it by name, and what would have made the same evidence an intrusion.