Security Engineer

Core mechanics of network protocols (OSI and TCP/IP models, TCP handshakes), IP addressing (IPv4/IPv6, subnetting), and packet structure.

Foundational security principles (Defense-in-Depth, CIA triad) and perimeter defense architectures including stateful firewalls, VPNs, and IDS/IPS.

Securing host operating systems (hardening, EDR architecture) and investigating compromised endpoints through volatile memory and disk artifact analysis.

Identifying, prioritizing, and remediating infrastructure vulnerabilities while aligning threat intelligence frameworks (like MITRE ATT&CK) with attacker methodologies

Building log telemetry pipelines, configuring forwarders, and writing custom correlation rules to actively triage and investigate security alerts.

Building a multi-step SOAR playbook (e.g., automated threat enrichment and IP quarantine) and executing an end-to-end capstone defense simulation.

Capturing and analysing traffic flows using Wireshark, inspecting packet headers, and troubleshooting basic network connectivity issues.

Configuring basic firewall rules/ACLs, setting up secure site-to-site VPN connections, and deploying signature rules on an intrusion detection system.

Deploying agent-based endpoint security, extracting memory dumps (e.g., using Volatility), and analyzing basic file and registry artifacts.

Running authenticated vulnerability scans (e.g., Nessus), prioritizing findings via CVSS scores, and mapping vulnerabilities to MITRE ATT&CK tactics.

Ingesting endpoint and firewall logs into a SIEM, writing custom detection queries (e.g., KQL or XQL), and investigating simulated alerts.

Designing and integrating automated incident response playbooks, API integrations, and orchestration workflows to contain threats without manual intervention.