guest@soc-07:~$ whoami

THREAT HUNTER

Cyber Security Consultant · Incident Responder · Professional Bad-Guy Botherer

experience: ~16 years in the field # DFIR, threat hunting & poking networks with sticks

guest@soc-07:~$ top -bn1 | head

load current load: 3 coffees, 2 timelines, ??? APTs

cpu 97% pattern-matching (YARA-accelerated)

mem 16 yrs of TTPs cached · 0 B swapped

net 10.0/10G full-duplex packet curiosity

disk 99% timelines, 1% sleep

temp cool under incident pressure

guest@soc-07:~$ ps aux --sort=-fun

1337incident_response 31337threat_hunting 4096dfir 443cloud_forensics 2049compromise_assessment 666malware_triage 8080network_forensics 22pen_testing 42ai_agents+mcp 1984yara 7deobfuscation

guest@soc-07:~$ history | grep career

2010defence_lab --soc-lead --pentest=ics,cni --ids-architect
2013soc --senior-analyst --ids-training --build-detection-tools
2014travel --asia --americas --study=forensics,ceh
2015soc --contractor --bank --runbooks --use-cases --mentor
2017ir --elite-team --apt --threat-hunt --train-clients
2019ir --senior-consultant --apt --compromise-assessment --coach # current position
nowai --agents --mcp --automate-ir # current focus

guest@soc-07:~$ ir --capabilities --verbose

Full-suite IR analysis: logs, endpoints, disk, memory & cloud
Scope, contain & eradicate APT actors across enterprise estates
Compromise assessments & enterprise-scale threat hunts
Coordinate client teams, technically and organisationally
Wrote advanced enterprise IR modules on YARA & deobfuscation; coach live cyber-range exercises
Built SOC runbooks, detection use cases & IR training for external teams
Design analysis workflows plus AI agent / MCP tooling that automates investigations

guest@soc-07:~$ show enterprise-stack

edrCrowdStrike · MS Defender · Sysmon · CarbonBlack

siemGoogle SecOps · QRadar · Splunk · ELK · LogRhythm

cloudAzure · Google Cloud

huntTrellix · GRR

forensicsVolatility · X-Ways · Plaso · DeepSpar

malwareIDA Pro · radare2 · OllyDbg · Sysinternals

pentestBurp · Kali · nmap · scapy · aircrack-ng · Kismet

guest@soc-07:~$ show running-config | grep network

network degreeFirst-class B.Sc. in Computer Networks

network stackTCP/IP inside out · VLANs · routing · switching · firewalls

network monitorVSS taps · distribution fabrics

network captureEndace · RSA NetWitness · Moloch full packet capture

network idsSourcefire · Snort: designed, tuned & taught

network eventIDS architect for a major military interoperability exercise

network pentestICS · national infrastructure · web apps · wireless

guest@soc-07:~$ ls /etc/certs/

GCFRcloud forensics responder GCFAforensic analyst CREAreverse engineering analyst CCNAnetwork associate SFCPSourcefire professional

guest@soc-07:~$ cat ~/trophies/ctf.log

# SANS NetWars combatant & CTF wins

1stCyber Defense NetWars (Team)

2ndCore NetWars Tournament

3rdDFIR NetWars Tournament (AI use)

# Other wins

winnerVolatility Malware & Memory Forensics training CTF

guest@soc-07:~$ ls -lt ~/training/

-rw-r--r--2026FOR578SANS Cyber Threat Intelligence

-rw-r--r--2025VOLATILITYMalware & Memory Forensics

-rw-r--r--2024FOR509SANS Enterprise Cloud Forensics & IR

-rw-r--r--2022SEC595SANS Applied Data Science & AI/ML for Cybersecurity

-rw-r--r--2018FOR508SANS Advanced DFIR & Threat Hunting

-rw-r--r--2015ARCSIGHTAnalyst training

-rw-r--r--2014-16ITU+CEHOnline forensics & ethical hacking courses

-rw-r--r--2013LOGRHYTHMCORE & AIE training

-rw-r--r--2013REVENGReverse engineering

-rw-r--r--2011-12CCNACisco CCNA

-rw-r--r--2011FOR558SANS Network Forensics

-rw-r--r--2010-11SOURCEFIREUser & system training

guest@soc-07:~$ cat ~/.hobbies

scuba diving# the only time I go deeper than a memory dump

off-road driving# mud > malware

travel# Asia & the Americas, routed manually

good food# favourite IOC: Indicator Of Cuisine

guest@soc-07:~$

threat_level: mildly caffeinated ptr 0x01F4:0x0132 bug signal strong scrollback