Cyber security student at Monash University, focused on detection engineering and incident response. I build detections, run the attacks they are meant to catch in an isolated lab, and write down what fired, what missed and what I changed.
Looking for: junior SOC analyst or detection engineering roles and internships.
Contact: LinkedIn · alvin.thomo@gmail.com · atho0105@student.monash.edu
Cyber-personal-portfolio A detection-and-response loop built from ten small tools: syslog SIEM, Sigma rules over a DuckDB data lake, a SOAR bot that only isolates a host after an analyst approves, Windows ETW process monitoring, attack emulation with Atomic Red Team, and evidence collection with Velociraptor. The README separates what is unit tested, replay tested and live-lab tested. Replay demo · CI
DriftWatch-Project Continuous security validation for a two-VM Windows lab. A Go agent runs only signed, benign tests; the server scores each one against Elastic and flags configuration drift. CI
- Macro document to mass file modification on a finance share: alert, raw evidence, timeline, queries, alternative explanations, disposition and why I would contain.
- Improving encoded PowerShell detection: a behaviour the rules missed, the new rule (EDR-PT-005), benign regression cases and what it still misses.
Both are written from replay data and say up front which parts are simulated.
Smaller builds for practising languages and fundamentals.
| Area | Projects |
|---|---|
| Security and systems | mini-os (x86 boot sector and C kernel) · port-scanner (Go) · file-integrity-monitor (Python) · logstats (Rust) · hexdump (C) · subnet-calculator (Python) · sysadmin-toolkit (Bash) |
| Data and SQL | campus-library-sql (SQLite) · study-habits-analysis (pandas) · numpy-game-of-life (NumPy) |
| Front end and fun | keyboard-meteors · pixel-pomodoro · terminal-dungeon · go-task-tracker · rust-maze |
Detection and response: Sigma, MITRE ATT&CK, Elastic, OCSF / ECS, Velociraptor, Hayabusa, Atomic Red Team, Nmap
Languages: Python, Go, PowerShell, C, Rust, SQL, TypeScript
Platforms: Linux, Windows (Sysmon, ETW), Docker, GitHub Actions
I grew up in Kerala, India, and have been taking computers apart, and then working out how to defend them, since I was a kid. These days that curiosity goes into my home lab, where I try to understand an attack well enough to write the detection that should catch it.