Joel Paul

I’m a SOC Analyst with 9 months of hands-on internship experience, focused on turning raw telemetry into actionable detections. I triage and investigate security alerts in Splunk, correlate Windows events and endpoint signals, and document investigation timelines to support incident decisions.

In my internship, I monitored and triaged SIEM alerts, analyzed Windows Security/System logs using key Event IDs (4625, 4624, 4688), and reconstructed attack chains by correlating multi-source logs. I also handled the incident response lifecycle—investigation, forensic timeline documentation, escalation, and closure—and supported detection improvement through dashboards and saved searches.

My portfolio shows the same mindset through full attack-to-detection workflows and rule engineering. I built a SOC Investigation Lab that ingests Sysmon events into Splunk, maps techniques to MITRE ATT&CK, and produces professional incident reporting; then I developed and validated Sigma rules and converted them into Splunk SPL and Microsoft KQL for cross-platform deployment.