What Dev demonstrated

Built a complete beginner SOC incident response workflow from phishing triage through containment and executive reporting. The work identified a malicious email, isolated the anomalous Rotterdam login as the compromise point, mapped events to kill-chain stages, and drafted a GDPR-style breach notification and incident summary grounded in the observed facts. The capstone also translated the real Continental case into a concrete control recommendation focused on exfiltration monitoring.

• Leakage-Free Threat Triage
• Anomaly-Driven Log Investigation
• Defensible Containment Sequencing
• Evidence-Based Security Communication