MELBOURNE, AUSTRALIA / SOC & BLUE TEAM
Behind every alert,
there’s a story.
I investigate it.
I’m Roni. A cybersecurity analyst with hands-on SOC experience, a builder’s mindset, and a habit of asking “what does the evidence tell us?”
Methodical by practice.Master of Cyber Security · RMIT
01 — SELECTED WORK
Less theory.
More evidence.
Tools I’ve built. Systems I’ve defended.
Investigations I can walk you through.
Each case study explains my contribution, approach and limitations. Illustrations below show the design, not captured client systems.
Explore more projects
02 — HOW I THINK
An alert is a starting point.
Context makes the call.
A walkthrough from the triage tool’s
synthetic SSH test fixture.
# Synthetic test data · not a client incident
Failed password for root
from 185.220.101.34FAILFailed password for root
from 185.220.101.34FAILAccepted password for root
from 185.220.101.34SUCCESS01 Read the signal
Repeated failed SSH logins target root. The source, account, host and timestamps establish the initial scope.
02 Correlate the evidence
The same source successfully authenticates seconds later. Check approved activity, authentication history and post-login commands before deciding whether the account was compromised.
03 Assess and escalate
The test fixture expects a high-severity true-positive suggestion. In a real investigation, validate context, preserve evidence and escalate suspected unauthorised access using the response runbook.
04 Leave a clear handover
Document the timeline, affected host, source indicator, confidence and outstanding questions. Recommend session review and containment through the authorised response process.
03 — EXPERIENCE
Built on
real-world work.
Security operations, technical support,
and the discipline of documenting both.
04 — THE PERSON
Curiosity brought me here.
Practice keeps me learning.
I like understanding how systems work—and what it looks like when they don’t.
I’m based in Melbourne, completing a Master of Cyber Security at RMIT. My background spans a SOC internship, hands-on IT support, and building and securing production infrastructure.
Outside work, I run a Wazuh lab, write detection rules and practise investigating the alerts I generate. I’m looking for an entry-level cybersecurity analyst role where I can contribute, ask good questions and keep developing.
MY ANALYST TOOLKIT
05 — FIELD NOTES