MELBOURNE, AUSTRALIA / SOC & BLUE TEAM
Behind every alert,
there’s a story.
I investigate it.
I’m Roni. A cybersecurity analyst with hands-on SOC experience, a builder’s mindset, and a habit of asking “what does the evidence tell us?”
Methodical by practice.Master of Cyber Security · RMIT
01 — SELECTED WORK
Less theory.
More evidence.
Tools I’ve built. Systems I’ve defended.
Investigations I can walk you through.
Each case study explains my contribution, approach and limitations. Illustrations below show the design, not captured client systems.
Explore more projects
02 — HOW I THINK
An alert is a starting point.
Context makes the call.
A walkthrough from the triage tool’s
synthetic SSH test fixture.
# Synthetic test data · not a client incident
Failed password for root
from 185.220.101.34FAILFailed password for root
from 185.220.101.34FAILAccepted password for root
from 185.220.101.34SUCCESS01 Read the signal +
Repeated failed SSH logins target root. The source, account, host and timestamps establish the initial scope.
02 Correlate the evidence +
The same source successfully authenticates seconds later. Check approved activity, authentication history and post-login commands before deciding whether the account was compromised.
03 Assess and escalate +
The test fixture expects a high-severity true-positive suggestion. In a real investigation, validate context, preserve evidence and escalate suspected unauthorised access using the response runbook.
04 Leave a clear handover +
Document the timeline, affected host, source indicator, confidence and outstanding questions. Recommend session review and containment through the authorised response process.
03 — EXPERIENCE
Built on
real-world work.
Security operations, technical support,
and the discipline of documenting both.
04 — THE PERSON
Curiosity brought me here.
Practice keeps me learning.
I like understanding how systems work—and what it looks like when they don’t.
I’m based in Melbourne, completing a Master of Cyber Security at RMIT. My background spans a SOC internship, hands-on IT support, and building and securing production infrastructure.
Outside work, I run a Wazuh lab, write detection rules and practise investigating the alerts I generate. I’m looking for an entry-level cybersecurity analyst role where I can contribute, ask good questions and keep developing.
MY ANALYST TOOLKIT
05 — FIELD NOTES