Mwaura John

I've built a four-project SOC portfolio on GitHub covering brute-force detection, network risk assessment, phishing simulation, and vulnerability scanning.

Using Splunk Enterprise, I simulated Windows brute-force activity, created detection queries and threshold alerts, correlated EventCodes 4625 and 4672, and produced an incident report with IOCs, MITRE ATT&CK mapping, severity classification, and containment recommendations.

I've used Nmap, SWAKS, Sendmail, and Nessus Essentials to identify network exposures, assess SPF/DKIM/DMARC weaknesses, simulate email spoofing, and prioritise vulnerabilities across Windows 11 and Metasploitable 2. My work documents evidence, risk ratings, remediation actions, and escalation-ready reporting.

My clinical and operations background has strengthened my ability to make decisions under pressure, follow protocols, maintain accurate documentation, and lead complex workflows. I'm transitioning these capabilities into a SOC Analyst role while continuing the TryHackMe SOC Level 1 learning path.