I have a Master of Information Technology in Cyber Security from Charles Sturt University (GPA 4.92) and work in IT support at Extratech in Canberra. Most of my security experience comes from labs I have built and run myself, mainly around SIEM, detection engineering and incident response with Microsoft Sentinel and Splunk.

• Currently working towards a junior SOC analyst role in Australia
• Preparing for the Microsoft SC-200 exam, planned for Q4 2026
• Day job covers Entra ID access management, Intune and general IT operations

The six projects below are the best picture of what I can do. Each repository documents the setup, the queries I wrote, the problems I hit, and screenshots of the results.

Security and SIEM

Cloud and identity

Automation

Dual-SIEM Detection Lab — Sentinel · Splunk · KQL · SPL · MITRE ATT&CK

A Windows Server honeypot on Azure sending the same Windows Security Events to Microsoft Sentinel and Splunk Enterprise at the same time. I wrote five detections in both KQL and SPL, covering brute force, account lockout, geo-anomaly, privilege escalation and new-user persistence, and mapped each one to MITRE ATT&CK. The Sentinel analytic rule generated incidents on its own from real traffic. The repo also has a write-up comparing how the two platforms handled the same detection logic.

Azure Sentinel Honeypot SIEM — Sentinel · KQL · PowerShell · Azure Workbooks

An intentionally exposed Windows Server 2022 VM that recorded over 1,400 failed RDP logins from more than six countries during the observation window. I wrote a PowerShell script that enriches each failed logon event with geolocation data from an API, ingested the output into a custom Log Analytics table, and built a Sentinel workbook that plots the attack sources on a map.

Azure Sentinel to Jira SOAR Pipeline — Sentinel · Logic Apps · Jira REST API · KQL

An automated path from detection to ticket. A KQL analytics rule picks up repeated failed Entra ID sign-ins, a Sentinel automation rule triggers a Logic App playbook, and the playbook creates a Jira ticket through the REST API with the incident details already mapped into the fields. I built it to understand how SOAR automation cuts down the manual steps between an alert firing and a ticket existing.

Azure Identity Security Lab — Entra ID · MFA · Sign-in and Audit Logs · Incident Response

An account-takeover exercise in Entra ID. I used the gap between MFA being enabled and MFA being enforced to take over a test account, then investigated it from the defender side: found the impossible-travel sign-in, rebuilt the timeline from the Sign-in and Audit logs, and worked through containment and recovery (session revocation, removing the rogue MFA method, password reset), following the NIST 800-61 incident response phases.

Splunk SOC Detection Lab — Splunk Enterprise · SPL · Windows Security Events · Azure

A standalone Splunk Enterprise deployment on an Azure Windows Server that was exposed to the internet. Splunk ingested 28,963 Windows Security events during the exposure window, and my SPL queries isolated four attacker IPs from that volume. I correlated failed logins (event 4625) with the resulting account lockout (event 4740), and when the brute-force attempts locked out the admin account I recovered it out-of-band with Azure RunCommand.

Fabric Fleet Telemetry Pipeline — Microsoft Fabric · KQL · Data Activator

KQL practice on streaming data through the Kusto Detective Agency challenge. The part worth reading is the query iteration: my first rule had no threshold and sent 15 alerts in under ten minutes, and I worked through three versions before landing on one that only fired on real anomalies. Same tuning process a Sentinel analytics rule needs, just on bus telemetry instead of security logs.

Master of Information Technology (Cyber Security) — Charles Sturt University, GPA 4.92 Coursework included digital forensics, cloud security, threat intelligence and data mining.

Bachelor of Computer Science and Mathematics — Birendra Multiple Campus

IT Support Specialist — Extratech (June 2025 to present)

• Handle 30+ support escalations a day across an enterprise Microsoft environment
• User and access management in Entra ID (IAM and RBAC) and endpoint management with Intune
• Work aligned to the ASD Essential Eight

Operations Support Specialist — Calvary Hospital (July 2022 to May 2025)

• Handled clinical and administrative data under the Australian Privacy Principles
• Focused on data accuracy and correct handling of sensitive information